[ { "id": "22cc1660-be2b-455a-b982-c6b5b70e2261", "name": "arctic-bashful-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 52550, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 825, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:10:39.045870+00:00", "ended_at": "2026-08-27T14:10:39.311875+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2275 }, { "id": "36eb2f83-d720-4fbf-88e8-b2b2bb86d121", "name": "barren-twilight-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 44744, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 337, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:05:39.875588+00:00", "ended_at": "2026-08-27T14:05:41.771555+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2184 }, { "id": "0df1f6c7-9098-4009-9dbe-b63024e6c927", "name": "crimson-crisp-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 36516, "username": "mailuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 830, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:05:31.611089+00:00", "ended_at": "2026-08-27T14:05:33.842343+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2193 }, { "id": "523fdf1f-cd18-4578-bb06-808128e94259", "name": "dutiful-crystal-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 53042, "username": "steam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:04:09.869400+00:00", "ended_at": "2026-08-27T14:04:11.405987+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2160 }, { "id": "948ef0ae-b1a8-469a-a716-6947083055e0", "name": "hidden-courtly-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 40586, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 829, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:03:41.618952+00:00", "ended_at": "2026-08-27T14:03:44.018826+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2170 }, { "id": "f1c9ad32-fb86-4909-9414-08f61e3f05cf", "name": "gnarled-airy-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 46340, "username": "it", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:02:44.546918+00:00", "ended_at": "2026-08-27T14:02:45.955061+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2142 }, { "id": "03e09488-6fbd-4a58-a7e6-9d802ca8d780", "name": "gloomy-weathered-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 44650, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 834, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:01:51.154232+00:00", "ended_at": "2026-08-27T14:01:53.311292+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2216 }, { "id": "db998d05-b649-442a-afe5-6fae9b692980", "name": "dewy-amber-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 54580, "username": "zjsf", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 336, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:01:07.505547+00:00", "ended_at": "2026-08-27T14:01:08.951013+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2137 }, { "id": "f76a8500-8dba-481b-bb0e-ddca5478f49a", "name": "arctic-painted-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 48716, "username": "aswin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 840, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:59:57.516556+00:00", "ended_at": "2026-08-27T13:59:58.701587+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2151 }, { "id": "02d94f97-51a7-477a-b442-27cb5437ccb7", "name": "mossy-electric-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 38488, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:59:37.357704+00:00", "ended_at": "2026-08-27T13:59:39.371099+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "92f79bfd-6af6-423b-ae4a-edc12c4026b0", "name": "barren-salty-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 49358, "username": "oracle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:58:11.390937+00:00", "ended_at": "2026-08-27T13:58:13.191461+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2121 }, { "id": "0c54333f-71e9-44e8-ab7d-a8d2058fe802", "name": "forlorn-prairie-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 52786, "username": "abcd", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 831, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:58:04.604391+00:00", "ended_at": "2026-08-27T13:58:06.394056+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2135 }, { "id": "8cb3b0fa-51f7-4c83-b350-c42fa84f4ada", "name": "alpine-weathered-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 36360, "username": "myuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:56:43.301357+00:00", "ended_at": "2026-08-27T13:56:44.588020+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2098 }, { "id": "d7d0ad8f-0bf6-4928-9ecc-e7d9ef924844", "name": "hazel-slender-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 56854, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 831, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:56:20.487122+00:00", "ended_at": "2026-08-27T13:56:22.536239+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "bd28fa80-f266-4e39-ad73-4ddea68a43ff", "name": "lively-burly-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 50760, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:55:13.593247+00:00", "ended_at": "2026-08-27T13:55:15.678836+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "289fedf4-e58f-44be-a953-c770c571fd79", "name": "arctic-granite-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 60932, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 833, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:54:33.403866+00:00", "ended_at": "2026-08-27T13:54:35.119495+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2129 }, { "id": "b8066e45-449f-459c-84fe-f63d50fc71c0", "name": "daring-dewy-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 37456, "username": "eva", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:53:37.878606+00:00", "ended_at": "2026-08-27T13:53:39.794676+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2075 }, { "id": "417dfc62-0fd9-43c9-a4f8-92cd41f9e472", "name": "brisk-wry-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 36774, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 839, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:52:51.857775+00:00", "ended_at": "2026-08-27T13:52:54.106539+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2161 }, { "id": "d35905db-dc88-46cb-bf64-12db1386a69a", "name": "loyal-jaunty-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 54154, "username": "terraria", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:52:14.024949+00:00", "ended_at": "2026-08-27T13:52:14.976452+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2077 }, { "id": "4e0ea59e-fb0d-4c7f-b6f3-6e1706d64a1e", "name": "plush-fickle-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 40842, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 836, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:50:56.424213+00:00", "ended_at": "2026-08-27T13:50:58.096000+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "512689b9-0866-4622-8b74-f092570cdfcd", "name": "faded-nimble-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 60362, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 339, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:49:19.683670+00:00", "ended_at": "2026-08-27T13:49:21.107205+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "0a096a81-70b7-4de7-9ece-55164067846e", "name": "pristine-ashen-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 44912, "username": "user10", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 830, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:49:09.457236+00:00", "ended_at": "2026-08-27T13:49:11.898519+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2082 }, { "id": "fd0e2781-f91d-49c5-812e-65104e405e6f", "name": "barren-vaulted-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 44270, "username": "jason", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:47:42.693713+00:00", "ended_at": "2026-08-27T13:47:43.374431+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2050 }, { "id": "4f0679fd-0de7-4821-8a97-c666f6559bf6", "name": "placid-smooth-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 48974, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 833, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:47:13.006250+00:00", "ended_at": "2026-08-27T13:47:14.698382+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "c1d61d73-1b49-4235-b367-8e10e936e78b", "name": "fringed-granite-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 55924, "username": "sammy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:46:10.305836+00:00", "ended_at": "2026-08-27T13:46:11.078524+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2047 }, { "id": "be430fc9-3418-4120-a9a2-95dfd66d578f", "name": "glassy-languid-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 53042, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 837, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:45:26.904360+00:00", "ended_at": "2026-08-27T13:45:28.490199+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "5449c50b-b2d5-4e74-8999-89b428743c96", "name": "sunlit-creaky-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 57110, "username": "halo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 834, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:43:34.225939+00:00", "ended_at": "2026-08-27T13:43:35.031718+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2049 }, { "id": "ce849b76-8909-425b-80e9-5b5c62f84f83", "name": "brisk-stormy-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 37034, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 827, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:40:15.293996+00:00", "ended_at": "2026-08-27T13:40:16.146140+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "1276b334-d8f4-44cb-8043-67c41dc46e0b", "name": "courtly-languid-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "164.92.161.148", "src_port": 53940, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:38:14.619040+00:00", "ended_at": "2026-08-27T13:38:15.269839+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "af3b7aec-5a42-4c47-88a7-02d439e8fa22", "name": "watchful-nimble-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 49038, "username": "vpnuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 794, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:11:34.264080+00:00", "ended_at": "2026-08-27T13:11:35.054224+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "f00c17a5-4d18-4688-b503-11db1633996b", "name": "woven-fabled-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57484, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:10:07.280852+00:00", "ended_at": "2026-08-27T13:10:08.428732+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e5fce962-9da0-4f2e-821c-7189ba7b8c1c", "name": "bronzed-vigilant-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 45808, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:08:36.969894+00:00", "ended_at": "2026-08-27T13:08:38.478631+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "eff6efd8-4e18-42b1-a81a-2b11487826dd", "name": "wry-sullen-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 46524, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 734, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:08:34.534956+00:00", "ended_at": "2026-08-27T13:08:35.347484+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a51727bf-109c-4e8a-a6ec-da8fe12737a8", "name": "creaky-brave-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42762, "username": "ardi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:08:00.808131+00:00", "ended_at": "2026-08-27T13:08:02.709755+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "e2827558-c0bf-403f-887a-ceed52b5ac6e", "name": "ashen-autumn-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52626, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:06:37.211124+00:00", "ended_at": "2026-08-27T13:06:39.140279+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "98f7846c-2b00-4d02-911d-880d43d131a8", "name": "early-salty-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 43030, "username": "pivpn", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:06:02.636910+00:00", "ended_at": "2026-08-27T13:06:04.735285+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "459198e0-3ad0-4842-ac57-15bd9617cee7", "name": "alpine-mindful-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 39800, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:04:33.784479+00:00", "ended_at": "2026-08-27T13:04:35.010501+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "5a3174d7-8e96-4b90-aa2a-2e5a18678ffd", "name": "gilded-gnarled-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47522, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:04:05.419096+00:00", "ended_at": "2026-08-27T13:04:06.597421+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "047a388a-5b15-466e-8856-1472d37c2eed", "name": "ginger-fearless-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 60034, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:04:04.740416+00:00", "ended_at": "2026-08-27T13:04:05.848593+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0f682362-d5e7-4e59-b4bd-42fd12ad9a28", "name": "orderly-mighty-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 59570, "username": "kd", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:02:26.363338+00:00", "ended_at": "2026-08-27T13:02:28.596587+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "b2ada6f7-2f54-4666-b63f-64729d310e48", "name": "amber-seaward-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47530, "username": "suraj", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:02:03.274397+00:00", "ended_at": "2026-08-27T13:02:04.383362+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "1a44aa23-34f2-4ab5-aab8-45dbfbbaff84", "name": "ancient-sullen-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 60000, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:01:22.570271+00:00", "ended_at": "2026-08-27T13:01:24.019166+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "1299ead7-4c8d-4d6e-b457-56d7f39f78da", "name": "faded-upland-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 34556, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:00:24.397509+00:00", "ended_at": "2026-08-27T13:00:26.219203+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "a5fda80f-7664-41f9-a4b0-921f3cd98379", "name": "russet-mindful-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 45620, "username": "admin1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:00:00.983466+00:00", "ended_at": "2026-08-27T13:00:02.535592+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "391361d1-85c4-4163-a3bc-009c9a036642", "name": "craggy-burly-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 39936, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1116, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:59:43.655151+00:00", "ended_at": "2026-08-27T12:59:44.427483+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2332 }, { "id": "fa311760-9d13-49dd-9e08-b5906e2ba25d", "name": "balmy-scarlet-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59974, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 458, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:58:39.450022+00:00", "ended_at": "2026-08-27T12:58:40.512283+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b81903e5-027f-4f03-b5d6-2907a4608d6e", "name": "brazen-prairie-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 34350, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:58:17.091596+00:00", "ended_at": "2026-08-27T12:58:18.000857+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "f5766448-702a-4f7c-9da4-fc116ddb10dc", "name": "deft-civil-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 56116, "username": "camera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:57:58.327929+00:00", "ended_at": "2026-08-27T12:57:59.404784+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "e60ce5f5-6dbd-4313-b46a-5991c59310f8", "name": "sandy-smooth-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 42206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 742, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:56:32.739534+00:00", "ended_at": "2026-08-27T12:56:33.501179+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "c6813f20-da54-43e4-8628-5456f230fb6c", "name": "meadow-thrifty-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 44592, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:56:13.484738+00:00", "ended_at": "2026-08-27T12:56:14.446308+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "dbd209f5-dc7b-4904-92d7-6615076b6410", "name": "alpine-patient-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 53752, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:56:01.232088+00:00", "ended_at": "2026-08-27T12:56:03.197873+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "4a14eff5-6cc0-41d5-9fc0-4fa9df943ae4", "name": "gallant-coral-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59934, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:55:54.249532+00:00", "ended_at": "2026-08-27T12:55:55.305917+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "77fe352d-ca94-40a2-91d5-880dded9378e", "name": "oaken-curious-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 43992, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:54:14.420708+00:00", "ended_at": "2026-08-27T12:54:15.991145+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "531cd024-fe1e-45ff-b7d0-72e35385721e", "name": "fierce-freckled-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 49812, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:54:05.492043+00:00", "ended_at": "2026-08-27T12:54:07.607201+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "dc7fc61d-c17f-4018-ba98-b97ee9b95beb", "name": "sullen-restless-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59912, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:53:15.753493+00:00", "ended_at": "2026-08-27T12:53:16.740548+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "da95395f-4d56-434c-89f1-495aa10cf491", "name": "golden-blithe-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 33882, "username": "uno50", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:52:16.604226+00:00", "ended_at": "2026-08-27T12:52:18.682721+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "b474a105-1c8f-4b7a-a107-b6513d19cb4c", "name": "wandering-icy-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 51332, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:51:59.998119+00:00", "ended_at": "2026-08-27T12:52:01.203481+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8dcaad64-e205-4415-9abc-8f80854c23a5", "name": "subtle-nautical-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59896, "username": "ftp_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:50:33.190371+00:00", "ended_at": "2026-08-27T12:50:34.730862+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2269 }, { "id": "4a112586-0f77-4dc3-aabb-2798e3b81c19", "name": "gilded-arctic-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 40032, "username": "deployer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:50:12.209359+00:00", "ended_at": "2026-08-27T12:50:14.002867+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "dd05d352-deb2-4686-8fd3-2bedf4f19476", "name": "frosty-electric-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 40492, "username": "dan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:49:57.375321+00:00", "ended_at": "2026-08-27T12:49:59.504062+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "e9ac9781-b6f7-4d1b-9710-b63a0400c5a2", "name": "scarlet-cunning-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52412, "username": "cps", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:48:15.012512+00:00", "ended_at": "2026-08-27T12:48:17.108387+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "2be61374-7157-471c-8912-bee3a0601c04", "name": "prairie-whispering-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59854, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:47:57.972467+00:00", "ended_at": "2026-08-27T12:47:59.174021+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a91607e8-e524-40e0-9e00-a167432f342e", "name": "sullen-marine-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 41434, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:47:51.603044+00:00", "ended_at": "2026-08-27T12:47:53.744422+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bcb3156c-dcdd-4d14-99f9-61451f6e2656", "name": "smoky-lucid-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 44914, "username": "ansible", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:46:06.093448+00:00", "ended_at": "2026-08-27T12:46:08.345573+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "5559e721-6a86-4e90-bdf4-92487a3505ca", "name": "salty-murky-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 55536, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:45:53.445340+00:00", "ended_at": "2026-08-27T12:45:55.408876+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "0a9c0917-4568-4ddd-b03b-9be891130aed", "name": "calm-frank-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 41086, "username": "cuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:45:40.558808+00:00", "ended_at": "2026-08-27T12:45:41.891143+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "8b312082-94b9-4a3e-a9b9-706b74821f85", "name": "dutiful-murky-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59826, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:45:18.685494+00:00", "ended_at": "2026-08-27T12:45:20.012052+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d744511d-1abc-472a-bd84-11855955c36a", "name": "fickle-reedy-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 43668, "username": "xie", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:44:00.286548+00:00", "ended_at": "2026-08-27T12:44:01.812020+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "2b4decfd-7187-4a21-81f0-e9b3932d8cf6", "name": "prairie-ancient-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57150, "username": "lighthouse", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:43:47.799358+00:00", "ended_at": "2026-08-27T12:43:49.271755+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "4d8f88f6-2dfe-4c51-b468-0240496d48b3", "name": "glacial-jolly-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59810, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:42:37.911180+00:00", "ended_at": "2026-08-27T12:42:39.439031+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "620f9d87-abf7-409c-8e49-4ac4e633c6cd", "name": "jaunty-wistful-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 47640, "username": "admin1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 289, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:41:57.495597+00:00", "ended_at": "2026-08-27T12:41:59.208027+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "c574abd1-bd65-4620-886b-60c576ef5dea", "name": "indigo-distant-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 41254, "username": "uno50", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:41:52.190247+00:00", "ended_at": "2026-08-27T12:41:54.311017+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "355e851e-b9d3-416e-b759-5ab909a942b8", "name": "gilded-vernal-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59782, "username": "vpnuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:40:00.259470+00:00", "ended_at": "2026-08-27T12:40:01.293761+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "0df86da6-776d-413b-9b44-d14ed647b27c", "name": "woven-solemn-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 46220, "username": "harsh", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:39:58.780008+00:00", "ended_at": "2026-08-27T12:39:59.943418+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "39da07dd-fb38-4fce-a527-19f9da5cd42c", "name": "snowy-lawful-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 46688, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:39:56.552160+00:00", "ended_at": "2026-08-27T12:39:58.483014+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "561a1baf-10b5-495f-9d07-ff7f1129e21d", "name": "seaward-twilight-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47306, "username": "xie", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:39:55.682275+00:00", "ended_at": "2026-08-27T12:39:56.861549+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "6dbcae5e-128a-47be-b4ba-4b55025af095", "name": "fearless-early-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 54184, "username": "inventory", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:37:52.731139+00:00", "ended_at": "2026-08-27T12:37:54.330812+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "3e59a2b6-5ca3-4b3c-a371-56c48ad903d9", "name": "crisp-honest-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 59326, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:37:49.832818+00:00", "ended_at": "2026-08-27T12:37:51.792145+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "cbc3e03a-99ce-43c4-b6d9-9adcf2da4159", "name": "scarlet-hardy-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59760, "username": "sendmail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:37:20.204796+00:00", "ended_at": "2026-08-27T12:37:21.458484+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "ca3841d0-2be8-40db-974c-3a1cfa7f3b05", "name": "coral-keen-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57430, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:35:51.340494+00:00", "ended_at": "2026-08-27T12:35:53.501899+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "d331a879-855c-450e-b3a6-ec98cec99240", "name": "brazen-upland-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37660, "username": "admin123", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 346, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:35:51.172555+00:00", "ended_at": "2026-08-27T12:35:52.995733+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "6bff129b-5dbc-4096-be09-3d86b0074ffd", "name": "mindful-airy-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 52984, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:35:41.014519+00:00", "ended_at": "2026-08-27T12:35:42.372176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "7821f2a4-c97d-4d17-94f9-e1d3d89ec220", "name": "sullen-pleasant-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59726, "username": "dockeruser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:34:45.065151+00:00", "ended_at": "2026-08-27T12:34:46.235008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "6162c3fb-7cf0-44a8-9579-9316ac5429bf", "name": "cosmic-dappled-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 49784, "username": "talha", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 727, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:34:33.053070+00:00", "ended_at": "2026-08-27T12:34:34.292996+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "a43d6df3-a362-41f0-ac3b-6d50b2b37097", "name": "flinty-foggy-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37116, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:33:44.889851+00:00", "ended_at": "2026-08-27T12:33:45.802782+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f741687a-2f74-4efe-8967-e1f14d778609", "name": "cobalt-velvet-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57180, "username": "lighthouse", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:33:42.482087+00:00", "ended_at": "2026-08-27T12:33:43.465726+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "76f346a1-f615-4192-8f06-bceee895d849", "name": "vigilant-eager-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51388, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:33:36.913486+00:00", "ended_at": "2026-08-27T12:33:39.163783+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "3ec0d238-b76e-40d5-8697-428d08619805", "name": "gentle-golden-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59690, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:32:06.271202+00:00", "ended_at": "2026-08-27T12:32:07.457659+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "063ba4fa-f4f3-4a10-a2ca-0fedab92e42f", "name": "dappled-rugged-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54790, "username": "server", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:46.854372+00:00", "ended_at": "2026-08-27T12:31:48.487515+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "99ccf506-6ffc-4033-8775-6988a850b13b", "name": "whispering-placid-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 51354, "username": "tempuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:43.140989+00:00", "ended_at": "2026-08-27T12:31:45.015186+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "bda5fd82-149a-466a-b1a2-d839e9b74824", "name": "emerald-tawny-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 56260, "username": "esadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:33.624503+00:00", "ended_at": "2026-08-27T12:31:34.849961+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2266 }, { "id": "0c76bfb4-836e-4008-83a9-7ac679dbfa15", "name": "crisp-hazel-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 59090, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:28.446059+00:00", "ended_at": "2026-08-27T12:31:29.412215+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "1609ea5b-d2dc-4f1e-96b4-c9b871295286", "name": "ruddy-humble-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 38402, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:42.393155+00:00", "ended_at": "2026-08-27T12:29:44.480765+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "e5ebfb99-0401-4147-b4b9-c5fff6839c7d", "name": "verdant-breezy-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 53220, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:36.925712+00:00", "ended_at": "2026-08-27T12:29:37.877115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "dcfb3d69-cc4c-4120-9d60-c07c2fa180eb", "name": "dappled-balmy-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59660, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:26.042174+00:00", "ended_at": "2026-08-27T12:29:27.519024+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "2f2acf93-459d-4ad4-b3b2-a666f3f3f304", "name": "dappled-wry-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 35920, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 296, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:15.331459+00:00", "ended_at": "2026-08-27T12:29:17.343007+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "195e9eb7-d36c-4b2a-96d4-beda6f9cbb6c", "name": "ivory-pewter-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 42630, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1024, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:02.832543+00:00", "ended_at": "2026-08-27T12:29:04.521724+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "046b6074-3b9c-4437-be5f-664598711280", "name": "foggy-snowy-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42818, "username": "kd", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:27:40.954237+00:00", "ended_at": "2026-08-27T12:27:41.855899+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "1047406f-7e04-4b83-9acb-2aca205290c8", "name": "regal-polar-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51166, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:27:37.812022+00:00", "ended_at": "2026-08-27T12:27:39.366564+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "25d66104-34c2-4c5f-ade7-028a24f97cd8", "name": "flinty-wistful-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 37032, "username": "sklep", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:27:13.056486+00:00", "ended_at": "2026-08-27T12:27:14.294599+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "968341c1-d34d-4470-806b-cb94fa62108f", "name": "languid-ivory-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59630, "username": "zsolt", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:26:45.087105+00:00", "ended_at": "2026-08-27T12:26:46.215932+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "e00e9b56-c236-4a32-a457-8a88a1fa0e97", "name": "electric-tawny-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33410, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 735, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:26:03.861784+00:00", "ended_at": "2026-08-27T12:26:05.485026+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7fe44b2d-599e-4b97-8931-4318d9559b8d", "name": "foggy-misty-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 49174, "username": "james", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:25:42.378488+00:00", "ended_at": "2026-08-27T12:25:44.615648+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "6164e871-e416-451f-b1d6-b7e6271cd5e2", "name": "jaunty-eager-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 41570, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 262, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:25:35.353754+00:00", "ended_at": "2026-08-27T12:25:37.508863+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "a7273483-844f-4f55-8407-0aa02975a1e6", "name": "cobalt-mellow-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 43194, "username": "danny", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:25:10.272603+00:00", "ended_at": "2026-08-27T12:25:12.003698+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "ef05cdd0-65b4-41d6-8783-5d75ac4d7dbb", "name": "genial-nautical-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59602, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:54.173175+00:00", "ended_at": "2026-08-27T12:23:55.165052+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "08df2f51-54d1-4c35-ae9f-f6a520b52ca0", "name": "valiant-glacial-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 44666, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:42.940114+00:00", "ended_at": "2026-08-27T12:23:44.192085+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f11e200c-eb70-48ff-a8d6-cccf34ada516", "name": "misty-rustic-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38258, "username": "frappe", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:34.967823+00:00", "ended_at": "2026-08-27T12:23:36.194833+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "28a4ee71-6a88-4b33-8da9-041526a4ef56", "name": "hazel-cobalt-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33152, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 730, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:18.917772+00:00", "ended_at": "2026-08-27T12:23:20.111497+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "8fcd060c-c8c5-4546-8ad4-bc9b9ab897a3", "name": "fierce-sterling-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52536, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:13.209762+00:00", "ended_at": "2026-08-27T12:23:14.733002+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "84d2a4e8-6fcc-4968-a1e4-a049d8e02664", "name": "russet-rugged-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 53984, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:47.348913+00:00", "ended_at": "2026-08-27T12:21:48.544087+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "cb1cf88d-956b-478c-8b56-58bf2ccaa813", "name": "arctic-distant-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 60522, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:33.027216+00:00", "ended_at": "2026-08-27T12:21:34.490931+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "5a07ff39-e5fb-4ef1-8ae6-f25237994c11", "name": "arctic-airy-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59582, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:15.821042+00:00", "ended_at": "2026-08-27T12:21:17.129068+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "a91ccc20-8ea6-4baf-bb5b-ebf14b1b5d42", "name": "feral-thawing-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 47744, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:10.503023+00:00", "ended_at": "2026-08-27T12:21:12.216098+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "d68e795d-0238-423e-96e6-2564f0322124", "name": "granite-graceful-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 36960, "username": "jose", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:20:26.707624+00:00", "ended_at": "2026-08-27T12:20:28.475440+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "5b8744b2-01e2-49be-bece-36ec39409a93", "name": "brisk-blithe-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 40896, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:19:44.225424+00:00", "ended_at": "2026-08-27T12:19:45.643083+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7e0a0c12-8ed0-4750-a081-597d1a4fbf65", "name": "muted-mighty-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 45496, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:19:35.417255+00:00", "ended_at": "2026-08-27T12:19:36.334650+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "2adc65a9-9a2a-48c2-951c-7a9693314980", "name": "early-flinty-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 49492, "username": "pivpn", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:19:01.318517+00:00", "ended_at": "2026-08-27T12:19:03.298001+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "90f233c9-a27d-4ed5-8e5a-ad096db4b742", "name": "murky-obsidian-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59556, "username": "radius", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:18:32.276938+00:00", "ended_at": "2026-08-27T12:18:33.654095+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "464cf29c-a5b7-42bb-a3fa-d990165de08a", "name": "brave-foggy-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57670, "username": "cuckoo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:17:38.862670+00:00", "ended_at": "2026-08-27T12:17:40.888936+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "41f9f301-0f99-43d0-b4ad-6d08299e70d8", "name": "canny-autumn-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 55478, "username": "ftp_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:17:37.816270+00:00", "ended_at": "2026-08-27T12:17:39.130521+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2269 }, { "id": "b79aced4-aad9-4169-a27d-82fe9b3e5e09", "name": "wandering-lonesome-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55980, "username": "ebi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:17:31.960154+00:00", "ended_at": "2026-08-27T12:17:33.416619+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "38e87d5e-ef1f-45a2-bb06-542130b3b7bf", "name": "hazel-upland-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55238, "username": "admin123", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:16:49.883425+00:00", "ended_at": "2026-08-27T12:16:52.008092+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "fe5b7c35-3ce5-4bff-b1e5-8e487ed5dab9", "name": "windswept-earnest-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59540, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:15:45.537099+00:00", "ended_at": "2026-08-27T12:15:47.083834+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "779e6bda-1ea1-48e9-a699-6b4db9dfc7e7", "name": "polar-rambling-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37324, "username": "sklep", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:15:38.945247+00:00", "ended_at": "2026-08-27T12:15:40.531770+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "4ce08521-74d7-484d-bd2b-50f1e132ad39", "name": "languid-dusky-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 34528, "username": "ftproot", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:15:30.385373+00:00", "ended_at": "2026-08-27T12:15:31.284296+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2307 }, { "id": "b0360082-aeed-4dc0-93ca-08aceb310c4f", "name": "tranquil-jovial-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33462, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 776, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:14:52.521448+00:00", "ended_at": "2026-08-27T12:14:53.775731+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "b0b0266a-9cb6-4fde-ae1d-7796c1b791bb", "name": "western-early-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 58892, "username": "anu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:14:45.268099+00:00", "ended_at": "2026-08-27T12:14:47.079215+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2240 }, { "id": "052656f7-0f3a-4553-91ff-893e15d0df4f", "name": "hushed-alpine-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57014, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:13:37.615119+00:00", "ended_at": "2026-08-27T12:13:38.850014+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d9d3e978-c9b7-4f69-b14e-6fc80085d958", "name": "cheerful-amber-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 36380, "username": "nico", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:13:31.294117+00:00", "ended_at": "2026-08-27T12:13:32.597213+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "34cbb54a-7eae-4549-a703-86074d83de0d", "name": "lofty-lively-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59510, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:13:04.316963+00:00", "ended_at": "2026-08-27T12:13:05.593037+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "094e7a1a-94b8-4321-8b66-12b7e420acef", "name": "wandering-jagged-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 46216, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:12:36.364067+00:00", "ended_at": "2026-08-27T12:12:37.449473+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "073159ff-aca6-436d-931a-c03df328242f", "name": "frank-marine-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38680, "username": "pal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:11:31.041436+00:00", "ended_at": "2026-08-27T12:11:32.356603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "5cd78e11-7c61-462e-a56c-3c4ae0d6382f", "name": "canny-grassy-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 51418, "username": "dan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:10:38.041176+00:00", "ended_at": "2026-08-27T12:10:39.407092+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "c391edc6-1849-44c2-accc-52206383b387", "name": "calm-cobalt-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59490, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:10:25.466051+00:00", "ended_at": "2026-08-27T12:10:26.800070+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2cebf8e2-48ac-4180-a403-6c2558213b56", "name": "dewy-ivory-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 34578, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:10:11.214918+00:00", "ended_at": "2026-08-27T12:10:12.392297+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7a3f793e-e0fa-41d6-94f4-330526e620df", "name": "prairie-fringed-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 37150, "username": "nikita", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:09:33.060767+00:00", "ended_at": "2026-08-27T12:09:34.216657+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "c9f47f74-03c9-4ed8-88d9-75e2f9ccd405", "name": "polar-shaded-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 41982, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 744, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:09:16.080070+00:00", "ended_at": "2026-08-27T12:09:17.503484+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2c2b0671-77e7-42ae-a6b3-cd3dcc9ff267", "name": "bold-hazy-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 51040, "username": "james", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 296, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:08:37.742133+00:00", "ended_at": "2026-08-27T12:08:38.736308+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "1f08357d-f587-4488-bc04-95d8113c1b3f", "name": "solemn-languid-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 44708, "username": "arash", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:08:12.443806+00:00", "ended_at": "2026-08-27T12:08:13.652211+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "910b8f7b-fee8-4c24-b161-48ba24d1dd46", "name": "jovial-grassy-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59466, "username": "remoteuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:07:45.835551+00:00", "ended_at": "2026-08-27T12:07:47.126183+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "ba97293b-35e3-4029-98f9-b3d8dc862f73", "name": "mossy-whispering-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 39734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:07:30.593003+00:00", "ended_at": "2026-08-27T12:07:31.628401+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "897bc932-7e0f-4cb1-bcd7-a13c7e8206ab", "name": "cobalt-jaunty-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 48700, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:06:31.484188+00:00", "ended_at": "2026-08-27T12:06:33.452428+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2293 }, { "id": "8a180bf0-13c3-42d5-9630-a41f97bfeb2f", "name": "watchful-vaulted-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 35922, "username": "ymoreno", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 772, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:06:17.365157+00:00", "ended_at": "2026-08-27T12:06:18.863737+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "8601141e-53d7-4fed-b4c3-ae24d34ccf98", "name": "jaunty-knotted-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 49574, "username": "yf", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:06:01.699560+00:00", "ended_at": "2026-08-27T12:06:02.807032+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2219 }, { "id": "f663e97f-d93e-405e-ae8b-edc39f1f03b2", "name": "electric-crystal-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 35516, "username": "filter", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:05:28.286111+00:00", "ended_at": "2026-08-27T12:05:29.969347+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "e3864833-b55d-4804-a61d-cbfd17828855", "name": "crisp-nimble-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59430, "username": "cuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 465, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:04:53.129122+00:00", "ended_at": "2026-08-27T12:04:54.471268+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "edbe3741-fa43-44ee-afff-dd246675910e", "name": "idle-mossy-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 50798, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:04:22.495934+00:00", "ended_at": "2026-08-27T12:04:24.262453+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "a1f41a3c-dbe5-46b1-8eb5-a6ad2b85ae3e", "name": "bashful-gallant-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57434, "username": "inventory", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:04:04.569186+00:00", "ended_at": "2026-08-27T12:04:06.052124+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2229 }, { "id": "bee65c64-e89f-48f1-85aa-d0bc1a21c78d", "name": "freckled-gallant-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 37618, "username": "newuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:03:29.469612+00:00", "ended_at": "2026-08-27T12:03:30.457544+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "4f6b69ad-0f71-4209-a73b-9586ab7760c9", "name": "dappled-ancient-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54628, "username": "gitlab", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:03:02.988728+00:00", "ended_at": "2026-08-27T12:03:04.565690+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "5493d2e7-4e58-45b0-a624-0fa3d82467be", "name": "whispering-muted-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55178, "username": "ardi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:02:12.460990+00:00", "ended_at": "2026-08-27T12:02:14.615074+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2214 }, { "id": "ff5a7f90-82ae-445e-abcd-3a34f5b2fea4", "name": "arctic-vernal-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59390, "username": "git", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:02:07.645167+00:00", "ended_at": "2026-08-27T12:02:08.629014+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "9dc33e9e-6f0d-4d60-940a-94ecf7d2212a", "name": "calm-slender-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 39344, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:02:01.018121+00:00", "ended_at": "2026-08-27T12:02:02.890480+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2217 }, { "id": "d2c5cdfc-67aa-4c21-b0e9-b364bc081355", "name": "glacial-diligent-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 54546, "username": "web", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:01:29.961194+00:00", "ended_at": "2026-08-27T12:01:31.230450+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "53b84977-5d1f-495c-9108-74efdc695480", "name": "primal-early-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 41662, "username": "azureuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 734, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:00:11.645160+00:00", "ended_at": "2026-08-27T12:00:13.363660+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "7fdbcea8-d5b0-44bc-bde7-8f0f9ea61396", "name": "cosmic-subtle-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 54752, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:00:01.262277+00:00", "ended_at": "2026-08-27T12:00:02.719823+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "e1fa51d8-9fef-4b9a-be27-f43984500b82", "name": "granite-eager-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 56422, "username": "camera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:00:00.688825+00:00", "ended_at": "2026-08-27T12:00:02.199792+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2201 }, { "id": "fdc83405-d69b-4c4d-97a4-88a93d5b90cd", "name": "foggy-hearty-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55200, "username": "ben", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:59:30.677901+00:00", "ended_at": "2026-08-27T11:59:32.432505+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "82b21af0-6317-4ca6-aa7a-7690d2eea1b4", "name": "nautical-glassy-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59356, "username": "harsh", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:59:14.999710+00:00", "ended_at": "2026-08-27T11:59:16.189008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "2e00d555-5ed4-4392-8b86-81cdb972bf6e", "name": "lonesome-sleepy-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 33432, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:58:03.193437+00:00", "ended_at": "2026-08-27T11:58:05.147503+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2190 }, { "id": "d53cdf74-acd9-4bbd-83fb-b23108eed00a", "name": "craggy-patient-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55448, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:58:00.026031+00:00", "ended_at": "2026-08-27T11:58:01.921668+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "2d1fa421-ff93-4aed-aa57-06924028b8a9", "name": "inland-tranquil-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 39950, "username": "arthur", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:57:29.746128+00:00", "ended_at": "2026-08-27T11:57:31.557802+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "aae1788c-398f-4c09-8467-32195a70a5c0", "name": "amber-tidal-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 45858, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:57:25.006006+00:00", "ended_at": "2026-08-27T11:57:26.484519+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "60aa76e5-0542-4bdd-8123-357a61fd53bf", "name": "silent-eager-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59312, "username": "frappe", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:56:36.170693+00:00", "ended_at": "2026-08-27T11:56:37.407084+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "49ccb497-05db-4148-8304-2c5d508b062b", "name": "curious-obsidian-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 60504, "username": "tempuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:56:00.052498+00:00", "ended_at": "2026-08-27T11:56:01.489475+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2187 }, { "id": "88eaab01-6b19-4586-ab2b-498b94696841", "name": "glacial-lonesome-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 53458, "username": "cps", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:55:59.814215+00:00", "ended_at": "2026-08-27T11:56:01.897737+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2169 }, { "id": "4d5d54b5-edc6-428e-9c7d-75a731c96b29", "name": "wistful-patient-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51392, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:55:38.100034+00:00", "ended_at": "2026-08-27T11:55:40.302328+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8dde47fb-39c4-4a49-b66c-fade3d342879", "name": "blazing-barren-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 40608, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:54:33.356037+00:00", "ended_at": "2026-08-27T11:54:34.786889+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "b35078f3-5fb4-43f6-b112-bf371f237986", "name": "lawful-amber-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42784, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:59.205091+00:00", "ended_at": "2026-08-27T11:54:00.212862+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2162 }, { "id": "31cedce7-da43-41ae-8b8c-2ea89c78e982", "name": "noble-gallant-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 37162, "username": "arash", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:58.013089+00:00", "ended_at": "2026-08-27T11:53:59.410019+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2173 }, { "id": "aa97e1aa-5e37-405e-b2e6-db81e26da46f", "name": "misty-downy-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59280, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:52.582483+00:00", "ended_at": "2026-08-27T11:53:53.880658+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "49149378-e990-4c2e-9b75-a4bd2715635e", "name": "prairie-wistful-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51632, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:37.567910+00:00", "ended_at": "2026-08-27T11:53:39.758008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "faf1ed23-d01e-449e-a490-07bd77bfa5a5", "name": "whispering-woven-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47952, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:56.198137+00:00", "ended_at": "2026-08-27T11:51:58.401380+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "fede980d-dd7e-465c-aa04-702f917a7a06", "name": "sunlit-crystal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 59174, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:47.943883+00:00", "ended_at": "2026-08-27T11:51:49.768626+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2162 }, { "id": "3c33f36c-a630-46af-b19d-d6e7e7451b5e", "name": "coastal-quiet-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33290, "username": "remoteuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:34.626497+00:00", "ended_at": "2026-08-27T11:51:36.118195+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "07fadb69-3a03-4cd7-b445-c508a052a31a", "name": "forlorn-kindly-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 48686, "username": "tomcat", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:34.450292+00:00", "ended_at": "2026-08-27T11:51:36.487603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "6e831502-1d1c-425e-bc76-b0098dc56c16", "name": "downy-crystal-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59254, "username": "azureuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:07.585521+00:00", "ended_at": "2026-08-27T11:51:09.054208+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "e1f66112-87f6-47df-a41b-341a29ff54b1", "name": "foggy-alpine-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 40216, "username": "ansible", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:49:59.749424+00:00", "ended_at": "2026-08-27T11:50:01.495060+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "644e4b81-4b47-4b7d-8f6c-f861c58a1d6b", "name": "calm-wooded-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 32910, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:49:46.426661+00:00", "ended_at": "2026-08-27T11:49:47.938006+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "698fee8c-2b89-46d0-b4cc-02b7c9959eb1", "name": "nautical-meadow-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 34680, "username": "stefan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:49:34.676771+00:00", "ended_at": "2026-08-27T11:49:36.574511+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "389c32c9-156e-4ee3-8363-321d6eea2cc4", "name": "shaded-placid-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 51716, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 781, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:48:39.937153+00:00", "ended_at": "2026-08-27T11:48:41.766906+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f2544d60-9dc4-4444-9fbe-2c1275375ffe", "name": "gleaming-twilight-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59226, "username": "suhail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:48:21.401089+00:00", "ended_at": "2026-08-27T11:48:22.834572+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "00030452-c690-4616-bbdc-5492e2710ee0", "name": "graceful-glacial-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37640, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:48:01.797262+00:00", "ended_at": "2026-08-27T11:48:03.011742+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "8f2732d6-d038-4dc0-a35d-551ca9dc0e00", "name": "western-patient-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57440, "username": "daniel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:47:33.422639+00:00", "ended_at": "2026-08-27T11:47:34.811523+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2155 }, { "id": "ae484628-f50a-4b60-b94c-163b3c388937", "name": "glacial-regal-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55856, "username": "whatsapp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:47:29.864277+00:00", "ended_at": "2026-08-27T11:47:31.822564+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "5cde8efb-2e28-4eef-8915-be0e7315f5c5", "name": "honest-thawing-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 39746, "username": "daniel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:57.022104+00:00", "ended_at": "2026-08-27T11:45:58.436862+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2133 }, { "id": "79ebdf76-ed7c-4355-95b7-93cad5300fce", "name": "ruddy-solar-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 40406, "username": "huser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1303, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:43.763868+00:00", "ended_at": "2026-08-27T11:45:45.556381+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "cc4aff71-36c6-4253-bb14-82644f66ca46", "name": "snowy-airy-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 39684, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:36.791237+00:00", "ended_at": "2026-08-27T11:45:38.839540+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "4e206720-f61b-40ef-bd09-5e14bf814593", "name": "diligent-earnest-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59210, "username": "huser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:30.084868+00:00", "ended_at": "2026-08-27T11:45:31.382747+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "b4cea9e1-3b11-4ff1-adaf-d947918878b5", "name": "frank-foggy-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55802, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:25.825292+00:00", "ended_at": "2026-08-27T11:45:27.889315+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "35d65587-5e48-476d-b292-410e632ac2a8", "name": "brisk-vernal-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 52084, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:43:58.000327+00:00", "ended_at": "2026-08-27T11:43:59.549429+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2118 }, { "id": "f0c3c9f2-c326-4b0e-aa47-ce9964411f8b", "name": "tangled-gloomy-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51330, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:43:36.779184+00:00", "ended_at": "2026-08-27T11:43:37.774544+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6d31d880-393f-40cb-bce0-572b4babfd4d", "name": "jovial-distant-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 39682, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:43:19.708244+00:00", "ended_at": "2026-08-27T11:43:21.106677+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "1427ae0c-299a-441f-be36-4cd1f2b5d923", "name": "hazel-sandy-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59190, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:42:48.712893+00:00", "ended_at": "2026-08-27T11:42:49.880090+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2291 }, { "id": "a9d9933a-f24d-47c7-b13f-224b574093e8", "name": "icy-patient-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 47686, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 884, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:42:43.634788+00:00", "ended_at": "2026-08-27T11:42:45.278090+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2225 }, { "id": "f82edd59-1d77-4e21-aabc-38e643c9955c", "name": "steady-emerald-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42768, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:41:54.297613+00:00", "ended_at": "2026-08-27T11:41:55.633851+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "9eac5760-2272-4284-9c94-36fd1e49ffbb", "name": "umber-twilight-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 44376, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:41:40.284750+00:00", "ended_at": "2026-08-27T11:41:41.525679+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7d4b415a-43b3-43d8-a0cb-ff2a3ce124f5", "name": "hazel-buoyant-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 60424, "username": "cuckoo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:41:12.249331+00:00", "ended_at": "2026-08-27T11:41:14.246162+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2110 }, { "id": "3714f82b-a475-4738-8c29-603e0ca03865", "name": "hazy-merry-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59156, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:40:03.459700+00:00", "ended_at": "2026-08-27T11:40:05.021398+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2221 }, { "id": "ae469160-671c-4a28-ba45-450fa52a6ad1", "name": "orderly-quartz-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 56544, "username": "radius", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1010, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:39:50.876941+00:00", "ended_at": "2026-08-27T11:39:53.188496+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2220 }, { "id": "3b68326b-5aa3-401b-bd27-1a060294ab3f", "name": "jovial-obsidian-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 49492, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:39:40.711783+00:00", "ended_at": "2026-08-27T11:39:41.785704+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "faae66eb-6f6c-4422-bff1-f43d752da64c", "name": "burly-clever-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 60628, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:39:06.381638+00:00", "ended_at": "2026-08-27T11:39:08.291010+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2107 }, { "id": "8cfa3a5a-651c-4953-aec2-2d764a29de42", "name": "drifting-amiable-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 41464, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:38:02.282253+00:00", "ended_at": "2026-08-27T11:38:04.558531+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2139 }, { "id": "cd3b0015-fb4b-40cd-99fa-6a8b36ea71d4", "name": "barren-gnarled-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 37934, "username": "ram", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:37:42.249902+00:00", "ended_at": "2026-08-27T11:37:43.573831+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "7721f4ad-4e82-489a-bbb8-fabdb93f19bd", "name": "steady-freckled-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59126, "username": "marco", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:37:28.743030+00:00", "ended_at": "2026-08-27T11:37:30.363744+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2211 }, { "id": "aabbf096-4217-4e17-88bf-ed63e4672b81", "name": "thrifty-umber-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 33370, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:37:15.360384+00:00", "ended_at": "2026-08-27T11:37:16.737688+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "cfc4bd2b-d7d2-4909-869e-dd8260b74390", "name": "cunning-bashful-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54944, "username": "zsolt", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 733, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:36:56.632904+00:00", "ended_at": "2026-08-27T11:36:57.998390+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "cbd5b6dc-9f75-425d-995c-e3c96f367da3", "name": "thorny-humble-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 58122, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:35:53.031371+00:00", "ended_at": "2026-08-27T11:35:54.476890+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2078 }, { "id": "972cfab2-cae0-46fa-8917-c5bc113c95f1", "name": "crystal-civil-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 58178, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:35:38.853087+00:00", "ended_at": "2026-08-27T11:35:40.500507+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "0ee2dc75-00d8-44cb-bb80-f67c2bde8732", "name": "shaded-thawing-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52936, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:35:12.681924+00:00", "ended_at": "2026-08-27T11:35:14.122034+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "179f1b43-15f9-4ddc-bfe6-fc456e9b1d7a", "name": "gallant-arctic-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59104, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:34:39.408017+00:00", "ended_at": "2026-08-27T11:34:40.897661+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2203 }, { "id": "f4008271-0046-4efb-9787-d756955e2972", "name": "boreal-twilight-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 38424, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:58.399131+00:00", "ended_at": "2026-08-27T11:33:59.737573+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "ff093cec-f590-4c1c-bd7f-e90971facd80", "name": "inland-tender-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 55966, "username": "anu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:52.709062+00:00", "ended_at": "2026-08-27T11:33:53.939195+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2057 }, { "id": "6227696f-f72d-4455-b05d-6bf07c9df165", "name": "gloomy-lanky-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 49668, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:34.784949+00:00", "ended_at": "2026-08-27T11:33:36.983931+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2280 }, { "id": "1000f9a7-5a10-4144-8b34-43e7dbc7b374", "name": "emerald-regal-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57586, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:13.248082+00:00", "ended_at": "2026-08-27T11:33:14.551311+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "030de59d-01f2-4271-a646-497462f59b23", "name": "velvet-barren-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37188, "username": "deployer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:59.093176+00:00", "ended_at": "2026-08-27T11:31:59.758305+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2055 }, { "id": "08c1f23a-db2c-4621-aca2-db71ff9f4baa", "name": "fleeting-foggy-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59086, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:49.000113+00:00", "ended_at": "2026-08-27T11:31:50.368150+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "3ed84bb1-120d-46aa-8e06-a66eae36dbb3", "name": "patient-calm-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55448, "username": "sysop", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:40.849882+00:00", "ended_at": "2026-08-27T11:31:43.052074+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2213 }, { "id": "439ccd49-b4b1-4e21-8cc7-4c818ee8528b", "name": "loyal-vernal-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 59900, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 770, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:08.661148+00:00", "ended_at": "2026-08-27T11:31:10.206764+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2234 }, { "id": "05ba90af-81c7-4248-812c-218af65de5d7", "name": "rambling-kindly-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 54726, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:08.652883+00:00", "ended_at": "2026-08-27T11:31:09.337804+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2106 }, { "id": "75e0d1c1-2119-4298-b11c-7305bd833462", "name": "barren-western-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 55158, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:29:53.805813+00:00", "ended_at": "2026-08-27T11:29:54.454812+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "4112604a-250e-44d3-9f97-5af87a43efea", "name": "golden-ivory-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 45946, "username": "dmp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:29:39.321131+00:00", "ended_at": "2026-08-27T11:29:40.409917+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "7338cb8b-e99c-4638-9e23-187ab0939eab", "name": "northern-granite-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 47946, "username": "yf", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:28:57.550615+00:00", "ended_at": "2026-08-27T11:28:58.161223+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2032 }, { "id": "21e6d30b-88fb-4bb2-b82f-051f6e4f2907", "name": "meadow-humble-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59058, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 458, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:28:52.029580+00:00", "ended_at": "2026-08-27T11:28:53.124626+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "a705bec3-cd3b-4e7e-8f91-ab00f2b4ef8a", "name": "salty-hazy-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 47314, "username": "suhail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:28:11.670538+00:00", "ended_at": "2026-08-27T11:28:12.932115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2174 }, { "id": "9045f81a-9116-4ae4-a163-1edf5f52e5a7", "name": "foggy-crimson-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 47924, "username": "elasticsearch", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:27:39.747860+00:00", "ended_at": "2026-08-27T11:27:40.968013+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2229 }, { "id": "c6b51dd0-0841-4892-9530-919ad3905d4e", "name": "coastal-noble-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59022, "username": "gitlab", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:26:05.452188+00:00", "ended_at": "2026-08-27T11:26:07.004443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2186 }, { "id": "1e946322-b3b0-4a41-8174-8fdf7e3823c4", "name": "nautical-fleeting-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38880, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:25:47.741804+00:00", "ended_at": "2026-08-27T11:25:48.902807+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "91abbb7b-49ed-451c-8cfe-7e9478c5b09f", "name": "bronzed-lawful-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 40558, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:25:23.670426+00:00", "ended_at": "2026-08-27T11:25:24.758400+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2216 }, { "id": "c8840f8d-e482-4e77-9d9f-92a5ac859bb2", "name": "weathered-hollow-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55546, "username": "pc", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:23:50.913027+00:00", "ended_at": "2026-08-27T11:23:52.864007+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2166 }, { "id": "c58e1721-0fd6-46fd-a197-2dbcadda5834", "name": "somber-merry-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58992, "username": "jose", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:23:21.713753+00:00", "ended_at": "2026-08-27T11:23:22.669445+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2151 }, { "id": "a75cc1be-52de-4db0-b1cf-2d5b0e5e628d", "name": "lucid-rustic-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 48652, "username": "sendmail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:22:38.955943+00:00", "ended_at": "2026-08-27T11:22:40.081557+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2160 }, { "id": "06819c64-1c2e-4244-8d27-8af746526dd0", "name": "faded-supple-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 60158, "username": "es", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:21:53.904943+00:00", "ended_at": "2026-08-27T11:21:54.796116+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2165 }, { "id": "24d7c804-9fde-44f8-8e50-745fa44a1dfe", "name": "buoyant-frank-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58984, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:20:44.739478+00:00", "ended_at": "2026-08-27T11:20:45.964341+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "10b309e8-a210-4ea5-9afb-99553f4e9272", "name": "hidden-vernal-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38484, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:19:55.134526+00:00", "ended_at": "2026-08-27T11:19:57.060505+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2156 }, { "id": "65b2be7b-71af-49b5-95cc-5a8bc3517970", "name": "quaint-umber-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 43774, "username": "newusername", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 769, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:19:54.975918+00:00", "ended_at": "2026-08-27T11:19:56.508392+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2152 }, { "id": "d0642adb-af0b-4529-9eda-cb5c44c3472a", "name": "thorny-gritty-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58958, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:18:08.352740+00:00", "ended_at": "2026-08-27T11:18:09.823471+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "31ecbce0-c621-4368-93f6-d98c1d670970", "name": "dapper-scarlet-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 34484, "username": "cri", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:17:55.068839+00:00", "ended_at": "2026-08-27T11:17:56.991047+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2130 }, { "id": "bb6850c9-3610-49ea-a531-8970c147c7ab", "name": "foggy-alpine-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 37220, "username": "sftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:17:14.435360+00:00", "ended_at": "2026-08-27T11:17:15.792348+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2134 }, { "id": "8b27942d-0dcd-45e3-a7e8-f4ed857f93af", "name": "indigo-lunar-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 41584, "username": "internet", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:15:51.417278+00:00", "ended_at": "2026-08-27T11:15:52.767016+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2134 }, { "id": "08395037-5832-4e3f-ac30-55c5752178df", "name": "glacial-arctic-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58916, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:15:26.463226+00:00", "ended_at": "2026-08-27T11:15:27.965331+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "ae0985ff-60a2-4fe7-9505-b9d26e2b9f6a", "name": "orderly-lanky-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 43652, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:14:14.600211+00:00", "ended_at": "2026-08-27T11:14:15.820123+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "2e967db4-e8dc-48f0-bae9-84ed39ef9def", "name": "painted-wry-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55470, "username": "soporte", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:13:56.109836+00:00", "ended_at": "2026-08-27T11:13:57.448176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2130 }, { "id": "4ce1b0fb-5f53-4d10-8e3e-dbd643796021", "name": "spirited-dewy-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58878, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:12:44.677709+00:00", "ended_at": "2026-08-27T11:12:45.956673+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "a04af3ce-123f-4997-8f7b-0701550677b7", "name": "coastal-wry-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 45448, "username": "zy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:11:54.590641+00:00", "ended_at": "2026-08-27T11:11:55.801473+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2108 }, { "id": "2b2de2d6-4bc6-4bb3-a551-2b3ef1f221f4", "name": "serene-woven-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 59536, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:11:27.267098+00:00", "ended_at": "2026-08-27T11:11:28.802420+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "a220ef4d-9bf8-4bf3-b410-3e6e2c56c42c", "name": "boreal-vaulted-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58856, "username": "ymoreno", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:09:59.421924+00:00", "ended_at": "2026-08-27T11:10:00.922018+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2111 }, { "id": "d1b1c94f-b001-4553-89af-c3e4fe3bb98a", "name": "brazen-bashful-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 46148, "username": "user10", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:09:53.807461+00:00", "ended_at": "2026-08-27T11:09:56.028502+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2099 }, { "id": "952a6526-a6a7-456f-9045-e3ed0686f432", "name": "sterling-blithe-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 48948, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:08:37.479205+00:00", "ended_at": "2026-08-27T11:08:38.769725+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2148 }, { "id": "b8acf46f-d88e-4167-b602-de532992d0f5", "name": "fearless-indigo-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 52358, "username": "u2", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:08:02.641859+00:00", "ended_at": "2026-08-27T11:08:04.185810+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2084 }, { "id": "0bd93430-fa3f-493c-8f5e-ffa7719fcc05", "name": "sunlit-orderly-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58830, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:07:12.995333+00:00", "ended_at": "2026-08-27T11:07:13.977959+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2148 }, { "id": "1a2b8542-1f42-4ca1-8cf9-960379fe54f9", "name": "candid-lucid-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 54274, "username": "omni", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:06:08.039876+00:00", "ended_at": "2026-08-27T11:06:09.411603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2069 }, { "id": "59a70d35-8b94-4192-be80-396906e8dad5", "name": "boreal-icy-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 59288, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T11:05:10.222730+00:00", "ended_at": "2026-08-27T11:05:10.327372+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "33ab2b22-eb26-47c3-88a8-dfa1c7ba5976", "name": "wry-woven-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58808, "username": "talha", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:04:33.095156+00:00", "ended_at": "2026-08-27T11:04:34.570908+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2083 }, { "id": "e55a5425-53b1-4040-9d4e-3fe62324749d", "name": "burly-sturdy-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54118, "username": "dockeruser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 761, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:04:17.340805+00:00", "ended_at": "2026-08-27T11:04:18.702216+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "46d56f95-b821-4afb-8d34-210d96db9b95", "name": "wandering-bitter-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55534, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:03:57.440172+00:00", "ended_at": "2026-08-27T11:03:58.593009+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "b7b5ff21-2ceb-4615-92db-df309a9811b6", "name": "glacial-peaty-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 56304, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T11:03:18.747849+00:00", "ended_at": "2026-08-27T11:03:18.878140+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9598293c-4e4b-4588-8ea4-83ce83aaed8c", "name": "rugged-cobalt-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58780, "username": "manish", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:01:52.129387+00:00", "ended_at": "2026-08-27T11:01:53.090909+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2079 }, { "id": "5932f125-89d9-4bdf-b36a-1ec913c4ed94", "name": "cheerful-graceful-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 35232, "username": "rahim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:01:46.289962+00:00", "ended_at": "2026-08-27T11:01:46.840537+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2050 }, { "id": "04ea648e-eb3a-4197-afa5-799e6ab971c2", "name": "obsidian-bitter-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 34330, "username": "marco", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 763, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:01:36.654589+00:00", "ended_at": "2026-08-27T11:01:38.022511+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2070 }, { "id": "09025e60-7128-4805-80be-da6a7e16df5f", "name": "prairie-quiet-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 53284, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T11:01:02.704675+00:00", "ended_at": "2026-08-27T11:01:02.986404+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "baa85c17-ea4d-4476-8b35-b03fb76f8046", "name": "fabled-gritty-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 50276, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:59:19.825070+00:00", "ended_at": "2026-08-27T10:59:20.008474+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "77608f33-c01d-44ce-bba6-fec8bce21a5a", "name": "dutiful-tranquil-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58746, "username": "sftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 455, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:59:12.587881+00:00", "ended_at": "2026-08-27T10:59:14.024809+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2068 }, { "id": "5f489023-1027-4c61-b7d2-92cb12f9752c", "name": "subtle-peaty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 53066, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 743, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:59:04.382355+00:00", "ended_at": "2026-08-27T10:59:05.668772+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "0511a491-8962-4b6e-9d52-4b74bded357f", "name": "deft-woven-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 36854, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:57:40.362900+00:00", "ended_at": "2026-08-27T10:57:41.025107+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2093 }, { "id": "2e34e403-a5e8-42a7-a918-e7c09159be99", "name": "crimson-prickly-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 47272, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:57:34.853596+00:00", "ended_at": "2026-08-27T10:57:34.971530+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "68496739-8a9a-467b-94a5-acefe8419b5b", "name": "breezy-calm-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 57250, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 770, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:56:28.265960+00:00", "ended_at": "2026-08-27T10:56:29.023573+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2059 }, { "id": "d9db2b6a-2f5a-4d3c-8929-928976740fde", "name": "dewy-valiant-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58726, "username": "newusername", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:56:20.234678+00:00", "ended_at": "2026-08-27T10:56:20.861006+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2064 }, { "id": "f3c5ef7b-2f3a-4202-8491-8bebf1cf07e5", "name": "arctic-tranquil-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 44258, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:55:51.401653+00:00", "ended_at": "2026-08-27T10:55:51.554551+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8d39b6fb-50a8-4265-b340-a786844a334a", "name": "downy-frugal-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 41246, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:54:09.325814+00:00", "ended_at": "2026-08-27T10:54:09.457279+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a98b8c64-f7c7-437b-8233-3196f219467d", "name": "sterling-lucid-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 46284, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:53:52.986704+00:00", "ended_at": "2026-08-27T10:53:53.797790+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "c4dc9bf3-9c93-4748-810e-7da8a48122cd", "name": "slender-wooded-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58704, "username": "server", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:52:59.834443+00:00", "ended_at": "2026-08-27T10:53:00.554651+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2050 }, { "id": "c5f4c947-05ce-48de-be9a-e9cba9399b68", "name": "serene-grumpy-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 38300, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:52:28.518686+00:00", "ended_at": "2026-08-27T10:52:28.708007+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "708dd740-c06a-46e7-8a93-0d0861681f29", "name": "marine-gnarled-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 35288, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:50:28.046484+00:00", "ended_at": "2026-08-27T10:50:28.234122+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "223a8369-38eb-4e4b-ac8d-7bdc65546e40", "name": "mottled-misty-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "178.43.50.171", "src_port": 42264, "username": "hruser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:48:45.475629+00:00", "ended_at": "2026-08-27T10:48:46.099879+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2044 }, { "id": "66acfe67-3063-403e-8266-5a5d52ec3ffe", "name": "thrifty-mindful-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 60540, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:48:45.405389+00:00", "ended_at": "2026-08-27T10:48:45.503432+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bf7ab1fe-9e8c-4031-ab6a-16a02dff3f7c", "name": "shaded-cheerful-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 57544, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:47:03.559223+00:00", "ended_at": "2026-08-27T10:47:03.673779+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e7628936-8342-404b-a8f3-6d9306284970", "name": "seaward-crystal-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.213.238.91", "src_port": 37396, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 799, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:45:58.236494+00:00", "ended_at": "2026-08-27T10:45:58.984026+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "3196d4f8-845f-4049-ac16-954ce2c5a29c", "name": "eager-tangled-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 54536, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:44:57.189553+00:00", "ended_at": "2026-08-27T10:44:57.293253+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1c289a18-b33d-4216-b800-326121ede8e9", "name": "solar-fabled-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "183.91.11.36", "src_port": 59360, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 829, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:44:14.502320+00:00", "ended_at": "2026-08-27T10:44:15.344863+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2049 }, { "id": "024b7bf6-9f9b-4b72-b83d-5b0fa9430f07", "name": "blazing-wistful-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 51544, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:43:13.090223+00:00", "ended_at": "2026-08-27T10:43:13.198396+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "36aaa70f-4579-4843-9d7b-3aa00af0d9d3", "name": "supple-russet-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 48544, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:41:25.358184+00:00", "ended_at": "2026-08-27T10:41:25.464217+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "26d02303-8f27-41ba-a19d-38d9dc69c7ee", "name": "oaken-wistful-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 45508, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:39:17.135887+00:00", "ended_at": "2026-08-27T10:39:17.243031+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e0862017-cd06-4cdd-b2e6-362b8950818c", "name": "distant-airy-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 42536, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:37:22.405541+00:00", "ended_at": "2026-08-27T10:37:22.508124+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b02ee85a-c71b-43a3-9bb9-395808e10749", "name": "crisp-fringed-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 39540, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:35:04.417692+00:00", "ended_at": "2026-08-27T10:35:04.526379+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b13aebb8-fa22-4ebd-b8f4-432df5530af2", "name": "nautical-forlorn-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 36542, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:33:13.714298+00:00", "ended_at": "2026-08-27T10:33:13.822199+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d8e99191-7ce0-442c-9588-94a2539dea12", "name": "glacial-northern-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 33516, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:31:23.522433+00:00", "ended_at": "2026-08-27T10:31:23.635217+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c65af88e-9f96-4a3c-b45c-7accbfd53d55", "name": "bashful-jolly-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 58732, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:29:15.794558+00:00", "ended_at": "2026-08-27T10:29:15.928682+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "77e5276a-9f0c-4686-b23b-db4886e21a45", "name": "jolly-diligent-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 55722, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:27:33.252728+00:00", "ended_at": "2026-08-27T10:27:33.361373+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "aa6d046f-fcb4-4c04-ba45-bb087a28081b", "name": "gentle-bronzed-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 52692, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:25:53.654004+00:00", "ended_at": "2026-08-27T10:25:53.807818+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8bb18579-bad0-4905-8c72-2929c7b3c502", "name": "watchful-painted-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 49674, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:24:12.326559+00:00", "ended_at": "2026-08-27T10:24:12.432143+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6369c46b-b95b-4764-83c7-83b4b1c8e40a", "name": "leafy-noble-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 46650, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:22:28.557111+00:00", "ended_at": "2026-08-27T10:22:28.663913+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3ab2c44a-dd1b-4722-a9d6-58af62ccc724", "name": "cunning-civil-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 43626, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:20:40.913880+00:00", "ended_at": "2026-08-27T10:20:41.042791+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c59e206a-a546-4e7b-a441-0350303b4b0a", "name": "windswept-prairie-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 40588, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:18:21.164419+00:00", "ended_at": "2026-08-27T10:18:21.272510+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ce863334-770f-4021-b1d1-ac32a6785b73", "name": "valiant-buoyant-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 37558, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:16:28.747786+00:00", "ended_at": "2026-08-27T10:16:28.903045+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0e26bd35-e14a-4ef8-b135-dc3217f6a4d5", "name": "drifting-fleeting-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 34510, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:14:38.840298+00:00", "ended_at": "2026-08-27T10:14:38.944328+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "97a12098-7e85-458a-926f-984771a6042e", "name": "watchful-foggy-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 59732, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:12:33.058874+00:00", "ended_at": "2026-08-27T10:12:33.061855+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ecef8e8c-486c-4fb9-9707-d4e989048d56", "name": "opal-crystal-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 56708, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:10:45.529027+00:00", "ended_at": "2026-08-27T10:10:45.637592+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "73ffda85-1b89-4d61-acb6-e83670fc4d4d", "name": "vaulted-nameless-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 53664, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:09:03.155140+00:00", "ended_at": "2026-08-27T10:09:03.263491+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f31b9cef-551d-4a78-be6a-2876fed70a0d", "name": "watchful-frugal-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 50616, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:07:16.470119+00:00", "ended_at": "2026-08-27T10:07:16.582248+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1f866733-8134-4f5d-89d7-c5ff2479ad60", "name": "supple-dapper-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 47540, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:05:24.365572+00:00", "ended_at": "2026-08-27T10:05:24.594218+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0dd9c107-d87f-495c-8021-13ec72c57990", "name": "indigo-brave-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 44526, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:03:32.849172+00:00", "ended_at": "2026-08-27T10:03:32.970206+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "74be07b2-6907-465c-ba78-ce5a12ad16af", "name": "pleasant-genial-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 41504, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T10:01:38.532734+00:00", "ended_at": "2026-08-27T10:01:38.634450+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bd25a654-2f22-4423-bca7-1b47635dbaab", "name": "thrifty-curious-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 38494, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:59:49.696960+00:00", "ended_at": "2026-08-27T09:59:49.799906+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "53d2f151-6261-4b0a-b6ef-19696a712833", "name": "vaulted-glacial-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 35438, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:58:01.881210+00:00", "ended_at": "2026-08-27T09:58:01.988753+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "38a90257-ecf7-4a84-bd26-252ad902f4b7", "name": "prairie-airy-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 60612, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:55:53.767263+00:00", "ended_at": "2026-08-27T09:55:53.871693+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "be0aef73-464d-4dfa-bd0d-282b2367103b", "name": "sleepy-faded-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 57586, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:54:04.811284+00:00", "ended_at": "2026-08-27T09:54:04.953361+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "078b32a4-b4b0-4df4-9dcc-a7206b1dc696", "name": "zealous-lofty-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 54566, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:52:17.290620+00:00", "ended_at": "2026-08-27T09:52:17.401711+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8f5bd653-4086-430f-95e8-3b58e785fd24", "name": "windswept-fringed-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 51524, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:50:26.424348+00:00", "ended_at": "2026-08-27T09:50:26.587018+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "548c5662-c993-4150-99d2-5eb575941d3f", "name": "tangled-mindful-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 48434, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:48:37.111610+00:00", "ended_at": "2026-08-27T09:48:37.315111+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "efc55195-8a2a-44b1-864b-9b3c83417887", "name": "supple-tranquil-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 45376, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:46:50.664961+00:00", "ended_at": "2026-08-27T09:46:50.789179+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c88559f4-a6b9-40b6-8686-7d8bdb87f996", "name": "tawny-calm-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 42328, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:44:45.478083+00:00", "ended_at": "2026-08-27T09:44:45.588004+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5890566c-8d6b-49c0-8b01-be8ad4758030", "name": "quiet-feral-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 39230, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:43:03.218119+00:00", "ended_at": "2026-08-27T09:43:03.391022+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bd0c3c96-c88b-4c02-a135-27dcea015f57", "name": "inland-grumpy-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 36150, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:41:19.962988+00:00", "ended_at": "2026-08-27T09:41:20.073001+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b6dffd4f-f535-4e77-adf1-8d9ece2e5725", "name": "breezy-crimson-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 33038, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:39:16.849368+00:00", "ended_at": "2026-08-27T09:39:16.952454+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "19c871fb-ac10-4830-b012-43742b9a5485", "name": "proud-obsidian-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 58194, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:37:31.605482+00:00", "ended_at": "2026-08-27T09:37:31.798004+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f2e6ef7c-d120-474f-a220-bba00b3a96fc", "name": "subtle-daring-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 55086, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:35:33.923158+00:00", "ended_at": "2026-08-27T09:35:34.032447+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "73ec52dc-d949-43ad-a5ff-db0fdb4a675b", "name": "balmy-tranquil-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 51964, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:33:39.431390+00:00", "ended_at": "2026-08-27T09:33:39.829852+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "12d4e7d4-0945-45e3-b013-898cc95f34d7", "name": "inland-faded-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 48876, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:31:46.852287+00:00", "ended_at": "2026-08-27T09:31:47.250724+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "daa0fcd3-e04d-4064-bb73-d0475bf925d2", "name": "ancient-freckled-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 45796, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:29:58.881624+00:00", "ended_at": "2026-08-27T09:29:59.236868+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fd8b64b2-2e3b-4315-b936-7322e44271e3", "name": "bronzed-breezy-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 42706, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:28:08.609116+00:00", "ended_at": "2026-08-27T09:28:08.729439+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "034f276c-062c-4aa8-ac31-f5475fb5a416", "name": "burly-indigo-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 39588, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:26:21.101729+00:00", "ended_at": "2026-08-27T09:26:21.246360+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "48321147-66eb-4acf-aaec-1decac3c9945", "name": "cunning-muted-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 36468, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:24:32.857794+00:00", "ended_at": "2026-08-27T09:24:33.005017+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "37d21917-4b70-499f-be22-40bba0e69af4", "name": "frank-lucid-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 33304, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:22:46.454169+00:00", "ended_at": "2026-08-27T09:22:46.657998+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4f9601fb-c465-4f20-9e08-594a530192fb", "name": "graceful-golden-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 58454, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:20:55.404603+00:00", "ended_at": "2026-08-27T09:20:55.517875+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "45822ab6-fd55-4ae2-a18c-7a913dc9339d", "name": "leafy-patient-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 55320, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:18:56.673747+00:00", "ended_at": "2026-08-27T09:18:56.784931+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5535f557-f1d5-416d-a061-a3f044d1bb47", "name": "primal-graceful-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 52198, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:17:06.397516+00:00", "ended_at": "2026-08-27T09:17:06.635302+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e0df4fff-4d77-4538-80bc-886302ba6e59", "name": "windswept-humble-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 49078, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:15:10.847365+00:00", "ended_at": "2026-08-27T09:15:10.956173+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "04d5fcb3-a289-4336-9806-a57740eef6d0", "name": "ancient-thorny-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 45972, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:13:16.431773+00:00", "ended_at": "2026-08-27T09:13:16.660202+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2cbb1d07-a3f9-4ec3-b5d8-50ed5b23807f", "name": "vivid-dewy-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 42868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:11:25.573292+00:00", "ended_at": "2026-08-27T09:11:25.765468+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "703c96ad-55eb-4e40-9533-2706792ffdc7", "name": "distant-plucky-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 39736, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:09:36.172137+00:00", "ended_at": "2026-08-27T09:09:36.494497+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8f8c89e5-1efd-4e00-852f-5bfc8a9cb4d2", "name": "fierce-arctic-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 36596, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:07:53.046684+00:00", "ended_at": "2026-08-27T09:07:53.160026+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "feae9b9c-fcd0-40d9-a6bf-4942e772cff4", "name": "genial-dappled-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 33468, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:06:12.813719+00:00", "ended_at": "2026-08-27T09:06:13.354579+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7160e2d2-746b-4bc3-9b8b-e4053e52071b", "name": "orderly-nameless-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 58536, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:04:30.369468+00:00", "ended_at": "2026-08-27T09:04:31.208151+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "26be28a9-ebb9-48c5-b4fa-2dbc214ea15a", "name": "noble-buoyant-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 55364, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:02:42.793658+00:00", "ended_at": "2026-08-27T09:02:42.952648+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2994afaf-9cfc-446b-85b2-2d40a610db1b", "name": "plush-rambling-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 52174, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T09:00:52.572729+00:00", "ended_at": "2026-08-27T09:00:52.682110+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "486378c9-41b6-47cd-a3d9-54b16c0702b9", "name": "ashen-indigo-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 49012, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T08:58:57.226275+00:00", "ended_at": "2026-08-27T08:58:57.367915+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7fbb0bfa-1743-4f04-85c8-aba245adb514", "name": "shifting-breezy-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 45806, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T08:57:03.148144+00:00", "ended_at": "2026-08-27T08:57:03.279665+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "45302c62-51b2-44b6-99b0-88c1852b1153", "name": "placid-civil-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "80.94.92.234", "src_port": 42596, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T08:54:58.712921+00:00", "ended_at": "2026-08-27T08:54:58.826486+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "af896936-a490-4587-a7f3-ab81ff6b066d", "name": "smooth-brazen-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 48650, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:24:30.157713+00:00", "ended_at": "2026-08-27T08:24:32.057443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e607a66e-d86f-417a-8c25-495054fc31bd", "name": "ruddy-electric-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57332, "username": "naresh", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:22:24.947577+00:00", "ended_at": "2026-08-27T08:22:27.121487+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "51573ac0-8de7-44fc-a08e-9e5955ee4be6", "name": "keen-wistful-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 37792, "username": "chrome", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 324, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:20:24.925073+00:00", "ended_at": "2026-08-27T08:20:26.162797+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "0627a051-cb7d-4548-9f26-e4a1dcd22a72", "name": "salty-grassy-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46482, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:18:24.060597+00:00", "ended_at": "2026-08-27T08:18:26.041370+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "034246a5-d8d9-4c4e-ac5d-4a6e0e936558", "name": "lonesome-salty-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55170, "username": "jona", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:16:18.543965+00:00", "ended_at": "2026-08-27T08:16:19.629855+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "0df1176f-e02b-4a65-b742-07c8d6d8c95d", "name": "curious-mellow-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 35630, "username": "drew", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:14:15.648000+00:00", "ended_at": "2026-08-27T08:14:16.660351+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "710045c9-1832-44be-936d-947afc7b6875", "name": "obsidian-sandy-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44310, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:12:11.874759+00:00", "ended_at": "2026-08-27T08:12:13.112396+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "2b464d23-4a9a-46c2-b421-cbddd6f10f66", "name": "vaulted-obsidian-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53000, "username": "oracle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:10:09.081161+00:00", "ended_at": "2026-08-27T08:10:10.584016+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "9b885516-221d-4f74-9843-6e3a63a4695a", "name": "pristine-thawing-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33456, "username": "noreply", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:08:10.525906+00:00", "ended_at": "2026-08-27T08:08:12.272829+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "976c541a-e9a4-44e6-807c-35a486a51cf9", "name": "deft-weathered-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42158, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:06:10.277587+00:00", "ended_at": "2026-08-27T08:06:11.370164+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "7352cbb2-5e48-49fc-9aca-9aaf3991e360", "name": "sooty-grumpy-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 50852, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:04:07.709778+00:00", "ended_at": "2026-08-27T08:04:09.679566+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "e709c5e7-de06-47f6-b4f4-902423420575", "name": "dusky-ruddy-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 59532, "username": "root2", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:02:04.456470+00:00", "ended_at": "2026-08-27T08:02:06.170696+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2305 }, { "id": "0786c559-9e56-498d-ae22-98af685d2aac", "name": "brave-fabled-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 39980, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:00:00.115200+00:00", "ended_at": "2026-08-27T08:00:01.100021+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "44d52360-b629-4e36-ab77-9c65f0ede2bf", "name": "stoic-nameless-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 48678, "username": "hduser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:57:46.188063+00:00", "ended_at": "2026-08-27T07:57:47.108583+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "d495506e-6814-4117-abf8-23cde34ce18c", "name": "rambling-keen-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57380, "username": "joy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:55:48.231939+00:00", "ended_at": "2026-08-27T07:55:50.258474+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "a52258ef-1abf-4146-ac32-2ac0ccdddfff", "name": "twilight-keen-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 37848, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:53:45.879113+00:00", "ended_at": "2026-08-27T07:53:47.990566+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "526ccc32-3278-43c2-8f81-18ffc9142ec7", "name": "watchful-subtle-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46544, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:51:40.258908+00:00", "ended_at": "2026-08-27T07:51:42.100928+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "c1b94865-7f0a-4723-a31c-97a41e6bf634", "name": "prairie-bitter-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55244, "username": "fecjl1yg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:49:36.271185+00:00", "ended_at": "2026-08-27T07:49:37.460032+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2283 }, { "id": "fe1dcfdf-bc8f-4ee3-89e4-bf34ef8e35ff", "name": "wooded-crisp-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 35710, "username": "ali", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:47:25.569658+00:00", "ended_at": "2026-08-27T07:47:27.048008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "370ee545-486b-492e-b59e-9b1bfd9f03f1", "name": "salty-fickle-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44410, "username": "iso", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:45:09.960697+00:00", "ended_at": "2026-08-27T07:45:12.211443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "877a14a2-757c-4dd2-b1ae-ceb3a9f27876", "name": "sterling-smooth-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53106, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:43:02.733485+00:00", "ended_at": "2026-08-27T07:43:04.546230+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "73424e1c-eca9-420a-a275-fb117c641912", "name": "coastal-steady-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33578, "username": "gabriel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:40:59.579350+00:00", "ended_at": "2026-08-27T07:41:01.875128+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "fe59c694-2267-4799-997e-6ec4815988c2", "name": "candid-hearty-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42276, "username": "ookla", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:38:56.662436+00:00", "ended_at": "2026-08-27T07:38:57.979912+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "604f475b-98ce-4588-a71b-09b89ef05a52", "name": "zealous-clever-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 50982, "username": "mc", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:36:54.895137+00:00", "ended_at": "2026-08-27T07:36:56.236864+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "adea8a27-3880-44a8-8881-07ebd64b8168", "name": "solemn-upland-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 59684, "username": "ugo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:34:54.128378+00:00", "ended_at": "2026-08-27T07:34:55.667393+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "00ca3838-07e4-43f2-97b7-a588c7bf3f10", "name": "gallant-golden-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 40150, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:32:38.561558+00:00", "ended_at": "2026-08-27T07:32:40.464658+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "94ff5a48-3683-4428-9c98-5452bc5b7406", "name": "valiant-plush-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 48844, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:30:31.282669+00:00", "ended_at": "2026-08-27T07:30:32.695110+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "33a416c2-d44e-49ee-b200-ed7af2034aa4", "name": "lofty-prickly-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57532, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:28:19.250693+00:00", "ended_at": "2026-08-27T07:28:21.427591+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d57e288b-31b9-43ea-8f21-f6def60e9813", "name": "indigo-smooth-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 37996, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:26:09.653360+00:00", "ended_at": "2026-08-27T07:26:10.832162+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2265 }, { "id": "04f01d6a-7440-4531-9115-1c058db21d70", "name": "verdant-civil-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46694, "username": "nfs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:24:11.491429+00:00", "ended_at": "2026-08-27T07:24:12.531091+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "9d5b2901-3556-4c9b-806e-07f5bc37792c", "name": "lonesome-vaulted-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55388, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:22:10.073480+00:00", "ended_at": "2026-08-27T07:22:11.907203+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2289 }, { "id": "8477a6bd-07cb-4fd4-979f-12cccb1b9c57", "name": "gnarled-cosmic-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 35846, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:20:03.763769+00:00", "ended_at": "2026-08-27T07:20:05.167051+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "0d6118a4-cf5f-4af8-8f8c-79841f70cd52", "name": "upland-frank-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44548, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 324, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:17:58.610375+00:00", "ended_at": "2026-08-27T07:17:59.905550+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2212 }, { "id": "c4de592d-d981-43c0-96be-27978e9ac70d", "name": "tranquil-lanky-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53256, "username": "testuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:15:48.499839+00:00", "ended_at": "2026-08-27T07:15:49.490791+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "51612420-ba2f-48c7-a878-ddb7d8c68fa8", "name": "rapid-orderly-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33730, "username": "florin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:13:39.204725+00:00", "ended_at": "2026-08-27T07:13:40.379332+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2202 }, { "id": "abd3c6b5-7436-4da3-979d-4c48f8db5de7", "name": "subtle-steady-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42436, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:09:47.536725+00:00", "ended_at": "2026-08-27T07:09:49.079769+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "ca13901f-7aba-45b0-aa2b-12b3ad3bcb7e", "name": "plush-snowy-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 51136, "username": "lbx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:07:42.310502+00:00", "ended_at": "2026-08-27T07:07:44.027632+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2171 }, { "id": "24b22214-e858-4730-bbcd-b41e935ab9f5", "name": "burly-gleaming-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 59844, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:05:41.758184+00:00", "ended_at": "2026-08-27T07:05:43.200621+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2164 }, { "id": "432ebf80-50b7-4ad3-8d3e-d2a0d938c8d6", "name": "ashen-lofty-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 40314, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:03:36.617750+00:00", "ended_at": "2026-08-27T07:03:37.835051+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "aaf58b00-0af5-4c4a-8453-752d4e5b8ee0", "name": "crisp-gritty-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 49024, "username": "steam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:01:26.047857+00:00", "ended_at": "2026-08-27T07:01:27.467618+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2140 }, { "id": "98796246-8261-44f3-a812-1a7c50633a0e", "name": "crystal-crimson-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57732, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:59:18.510870+00:00", "ended_at": "2026-08-27T06:59:20.656529+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "cd337afe-137f-4ac9-bc9a-20e8dcbd7860", "name": "rustic-zealous-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 38200, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:57:11.711848+00:00", "ended_at": "2026-08-27T06:57:13.878106+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "cfed138f-a5a9-435f-8c03-b58c4ce0cb34", "name": "mindful-amiable-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46902, "username": "mom", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:54:59.278006+00:00", "ended_at": "2026-08-27T06:55:00.845150+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2099 }, { "id": "b40208fd-5f2f-42cf-992b-9a2614c05fa3", "name": "weathered-blithe-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55604, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:52:58.776446+00:00", "ended_at": "2026-08-27T06:52:59.765840+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "8d9eac5c-44da-46cf-a5e9-5ae46d66d5c3", "name": "graceful-dappled-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 36070, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:50:59.036810+00:00", "ended_at": "2026-08-27T06:51:00.435845+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2139 }, { "id": "14f6b565-1d2d-496f-965d-781a68b86c70", "name": "plush-rambling-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44774, "username": "dante", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:48:54.647274+00:00", "ended_at": "2026-08-27T06:48:55.796824+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2074 }, { "id": "8f597acf-c9c6-4d03-8c67-09f0068dd656", "name": "amiable-supple-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53484, "username": "weblogic", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:46:51.982788+00:00", "ended_at": "2026-08-27T06:46:53.144929+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2072 }, { "id": "c80a064c-9494-40b3-abd5-4f340e56be99", "name": "orderly-rapid-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33954, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:44:42.100296+00:00", "ended_at": "2026-08-27T06:44:42.758496+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2104 }, { "id": "72dafc1e-5c2d-46a1-8017-878ce5120fd5", "name": "mellow-eager-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42658, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:40:44.085073+00:00", "ended_at": "2026-08-27T06:40:44.701749+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "f42914df-f515-423f-bef8-b1a41904d8d6", "name": "solar-dewy-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 35656, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:28:11.792455+00:00", "ended_at": "2026-08-27T06:28:11.903385+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d9dfa0dc-aea2-4ba8-8f25-e5f8e793607b", "name": "vivid-vernal-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 32794, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:26:18.884108+00:00", "ended_at": "2026-08-27T06:26:18.990253+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cfa063ae-049d-4cd6-9733-d12a95e0ace9", "name": "jaunty-wistful-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 58180, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:24:26.590395+00:00", "ended_at": "2026-08-27T06:24:26.703289+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b2b208b3-735a-489c-9bb0-a397c7f1be4c", "name": "thrifty-jaunty-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 55334, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:22:35.121451+00:00", "ended_at": "2026-08-27T06:22:35.275011+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ecf4dfe8-503c-4a34-bb93-621cd3a65185", "name": "cheerful-candid-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 52470, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:20:44.236898+00:00", "ended_at": "2026-08-27T06:20:44.406915+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c6e2a4ae-0ebd-4ae9-a930-6cd7ee406548", "name": "earnest-downy-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 49612, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:18:56.986811+00:00", "ended_at": "2026-08-27T06:18:57.098736+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "796d8745-1d6b-4a34-91a0-5827fd74c40e", "name": "vaulted-hollow-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 46774, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:17:08.518114+00:00", "ended_at": "2026-08-27T06:17:08.631893+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "df825144-4938-41b1-a473-539ffc012e30", "name": "fringed-frugal-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 43906, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:15:16.983902+00:00", "ended_at": "2026-08-27T06:15:17.098648+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "40a6001b-4974-4389-9401-f7fb3388fde0", "name": "vivid-languid-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 41054, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:13:18.509803+00:00", "ended_at": "2026-08-27T06:13:18.620540+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6ec565d6-eef6-4897-85ad-28cd7925c4d2", "name": "alpine-coral-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 38150, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:11:18.657097+00:00", "ended_at": "2026-08-27T06:11:18.805853+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c368a672-3f5a-45d5-9af9-e7ea0425ac28", "name": "foggy-windswept-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 35268, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:09:18.893021+00:00", "ended_at": "2026-08-27T06:09:19.004158+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "16117087-3752-451c-9720-a3643c22d9eb", "name": "whispering-ivory-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 60606, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:07:21.187319+00:00", "ended_at": "2026-08-27T06:07:21.403356+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bb9e24ee-ba9e-4a47-b32a-6fd122053e47", "name": "ruddy-smooth-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 57744, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:05:26.721589+00:00", "ended_at": "2026-08-27T06:05:26.843138+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a291dd2d-90c0-4584-9cf3-1882218f93c3", "name": "mighty-chilly-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 54908, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:03:34.839655+00:00", "ended_at": "2026-08-27T06:03:34.985065+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a4622992-1343-4a73-af0e-02375165af41", "name": "prickly-ivory-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 52054, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T06:01:43.654774+00:00", "ended_at": "2026-08-27T06:01:43.763943+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3a35d275-6c1f-49e2-a2ac-8fad2050e02b", "name": "buoyant-hazy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 49170, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:59:50.706472+00:00", "ended_at": "2026-08-27T05:59:50.821970+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "561e0170-c00b-4a10-945c-f2c3dd179a0c", "name": "prickly-mellow-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 46308, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:57:58.363457+00:00", "ended_at": "2026-08-27T05:57:58.737621+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a77df760-1b64-494a-bfd2-f702ae30c00a", "name": "lanky-steady-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 43416, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:56:02.220322+00:00", "ended_at": "2026-08-27T05:56:02.337609+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "990b7d74-a263-46ba-886e-57ffe9b15cc8", "name": "grumpy-fearless-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 40554, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:54:08.785685+00:00", "ended_at": "2026-08-27T05:54:08.929336+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6ac60bea-1c54-4953-bff1-ffb36751b9ad", "name": "sterling-quiet-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37062, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:53:51.433201+00:00", "ended_at": "2026-08-27T05:53:52.777417+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "11ca6e1e-b334-401d-80ea-a85e5c33411d", "name": "lanky-burly-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 37700, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:52:14.199575+00:00", "ended_at": "2026-08-27T05:52:14.329815+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "695e8133-86b5-4fef-a0c2-5d44f10b84ad", "name": "arctic-jagged-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58460, "username": "kkk", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:51:49.646369+00:00", "ended_at": "2026-08-27T05:51:50.787856+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "73054630-4e9e-40c7-be7e-be17aa90f095", "name": "polar-golden-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 34826, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:50:21.741674+00:00", "ended_at": "2026-08-27T05:50:21.892046+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "15c8f7d1-9c5f-4336-a6bc-91df637f559c", "name": "civil-tawny-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 35266, "username": "xiaolin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:49:54.223925+00:00", "ended_at": "2026-08-27T05:49:56.159164+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "89aa9e54-9bb6-4cf5-a6b4-c3907f43fca8", "name": "faded-windswept-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 60208, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:48:34.074188+00:00", "ended_at": "2026-08-27T05:48:34.333093+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e7767d99-2f3a-4355-b785-faacccfdda2b", "name": "quartz-primal-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 55226, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:47:51.436453+00:00", "ended_at": "2026-08-27T05:47:53.469714+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "ebce7be3-48a0-48ff-a1b8-82598026ddd9", "name": "bold-fickle-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 57342, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:46:43.458125+00:00", "ended_at": "2026-08-27T05:46:43.560201+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c86d61c7-b2bb-4e53-b47d-17a3df0cf06a", "name": "stoic-tawny-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58176, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:45:53.986321+00:00", "ended_at": "2026-08-27T05:45:55.304401+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "529c561c-05d5-428a-822f-d58089882c4c", "name": "grumpy-quiet-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 54456, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:44:54.788654+00:00", "ended_at": "2026-08-27T05:44:54.893461+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "58ff4cae-b44a-4118-8862-2327b3d79ae9", "name": "honest-vigilant-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 43386, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:43:53.133955+00:00", "ended_at": "2026-08-27T05:43:54.758512+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "ace51802-61ec-41e4-8a58-a477d2acfa2e", "name": "buoyant-painted-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 51572, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:43:05.160128+00:00", "ended_at": "2026-08-27T05:43:05.264811+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f3ccc5e2-0539-4200-8222-3abf799f8e95", "name": "jolly-daring-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58808, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:41:55.054504+00:00", "ended_at": "2026-08-27T05:41:57.305487+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6358979d-8ba8-4453-a60f-e369272f3d6e", "name": "quartz-canny-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 48678, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:41:09.873224+00:00", "ended_at": "2026-08-27T05:41:09.995878+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a41147b0-202e-43e5-9f3e-205428a8b2b4", "name": "lunar-sandy-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42688, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:39:55.667521+00:00", "ended_at": "2026-08-27T05:39:57.381533+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2300 }, { "id": "2f579118-7b77-4059-89e8-5d20622b4e58", "name": "salty-wiry-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 45804, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:39:10.785110+00:00", "ended_at": "2026-08-27T05:39:10.966148+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8c6bd2bf-d09d-425a-8a54-da7c84c6eb5e", "name": "wry-diligent-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 60366, "username": "albert", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:37:49.360758+00:00", "ended_at": "2026-08-27T05:37:51.088097+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "328aaf62-cc3f-4420-950d-dc9f2f42d40d", "name": "sincere-creaky-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 42894, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:37:10.157053+00:00", "ended_at": "2026-08-27T05:37:10.261772+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8748a154-f78f-4b6f-a99e-fd7766247cef", "name": "civil-chilly-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 57024, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:35:51.369794+00:00", "ended_at": "2026-08-27T05:35:53.046591+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "1ee60900-c5c9-4502-b027-1ea88c2b0fad", "name": "valiant-arctic-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 39998, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:35:14.022491+00:00", "ended_at": "2026-08-27T05:35:14.136051+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5051a227-a361-4f9d-87af-aec86904a535", "name": "gnarled-glassy-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 38680, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:33:51.635172+00:00", "ended_at": "2026-08-27T05:33:53.597740+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2300 }, { "id": "1d9d270a-a9dd-4773-82ff-86e7a9870ee6", "name": "boreal-sunlit-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 37112, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:33:18.934122+00:00", "ended_at": "2026-08-27T05:33:19.048122+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "73e31b22-0e57-47e8-8e1a-78697170d57e", "name": "jovial-sturdy-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 46184, "username": "f", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:31:55.971028+00:00", "ended_at": "2026-08-27T05:31:57.647501+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2240 }, { "id": "2b3eb9a4-9d87-45ec-8751-94c6278f8750", "name": "flinty-glacial-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 34192, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:31:27.140031+00:00", "ended_at": "2026-08-27T05:31:27.252560+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "81381a86-19b8-4448-9172-d584b743fa7b", "name": "bronzed-russet-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37166, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:29:57.271815+00:00", "ended_at": "2026-08-27T05:29:58.450742+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "14e26c10-5b81-48ed-a81c-b5a976012490", "name": "faded-freckled-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 59528, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:29:36.760640+00:00", "ended_at": "2026-08-27T05:29:36.874493+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "71c78d73-7759-4327-9c61-945c7b6a8aba", "name": "daring-dapper-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 34888, "username": "penis", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:28:01.495898+00:00", "ended_at": "2026-08-27T05:28:03.406546+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "6b8b62bf-3ab3-4e79-99cd-3c8d4ecccdae", "name": "crimson-quartz-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 56656, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:27:44.166172+00:00", "ended_at": "2026-08-27T05:27:44.322255+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "40f70538-dde7-46ec-9a70-9ce085c021d7", "name": "russet-hazel-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 53762, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:25:49.231994+00:00", "ended_at": "2026-08-27T05:25:49.397657+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b0a180a8-18a9-40e2-a335-e1a032c0f286", "name": "seaward-candid-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 53644, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:25:48.520057+00:00", "ended_at": "2026-08-27T05:25:50.639940+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "172a93f3-39d4-4314-ba20-f7831639b04f", "name": "cunning-sullen-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 50846, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:23:49.195965+00:00", "ended_at": "2026-08-27T05:23:49.309845+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "61a90769-d1d3-49b9-b13a-2b1f593dfb1a", "name": "cosmic-tidal-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 51752, "username": "sanjay", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:23:37.119701+00:00", "ended_at": "2026-08-27T05:23:38.045053+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "02fb37ba-cd0f-4d8c-bad7-d6432009f582", "name": "wistful-whispering-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 47948, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:21:48.124915+00:00", "ended_at": "2026-08-27T05:21:48.235000+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e5574279-3724-4e92-ba39-eab1e8dc9035", "name": "valiant-tawny-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 48054, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:21:36.906836+00:00", "ended_at": "2026-08-27T05:21:38.907844+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7b7bc21e-cbdf-41eb-9fcf-3fb472d2aea3", "name": "eager-hidden-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 45072, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:19:55.753101+00:00", "ended_at": "2026-08-27T05:19:55.890230+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f157b3ed-5a6b-47d8-a155-d1f9a5950881", "name": "knotted-umber-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 51482, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:19:33.158493+00:00", "ended_at": "2026-08-27T05:19:34.654119+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "af85e40d-25dd-4657-b5c4-5cb9d16254e3", "name": "lunar-hushed-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 42194, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:18:02.041401+00:00", "ended_at": "2026-08-27T05:18:02.201244+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c1b85829-221e-438c-b29b-5130ef5bb391", "name": "brave-fabled-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37004, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:17:34.629781+00:00", "ended_at": "2026-08-27T05:17:36.277194+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0f686cdb-2153-45b8-a8a7-e8ca447dc85b", "name": "ashen-glassy-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 39282, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:16:07.765039+00:00", "ended_at": "2026-08-27T05:16:07.909888+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "42c210ed-e913-4c0c-97db-e37a7652d4ca", "name": "marine-deft-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 36426, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:15:29.696246+00:00", "ended_at": "2026-08-27T05:15:31.302382+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b0883ed5-fed1-4419-820d-3984f99a3bd0", "name": "electric-glassy-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 36400, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:14:13.971117+00:00", "ended_at": "2026-08-27T05:14:14.191245+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ebbba6e9-486d-4d7b-b56e-70f766572656", "name": "vigilant-gleaming-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 33530, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:13:29.602717+00:00", "ended_at": "2026-08-27T05:13:31.749725+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "989f6f62-3e76-442c-aef1-a0a11b14fb50", "name": "burly-sturdy-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 33490, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:12:20.738292+00:00", "ended_at": "2026-08-27T05:12:20.989705+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "54797db9-35cd-4ca4-9cb6-71d62cdaf86f", "name": "airy-tangled-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42096, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:11:33.479653+00:00", "ended_at": "2026-08-27T05:11:34.974885+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "9e93daed-7cdd-410b-a43f-6e6717f955cf", "name": "noble-airy-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 58812, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:10:25.585116+00:00", "ended_at": "2026-08-27T05:10:25.719154+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a29c6c7a-0f36-4218-847d-a12fca09a8c8", "name": "sandy-gallant-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 41764, "username": "toto", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:09:39.125729+00:00", "ended_at": "2026-08-27T05:09:40.368070+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "de02d280-13e7-4257-a04d-c2a66edfbc4a", "name": "misty-brave-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 55882, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:08:31.720880+00:00", "ended_at": "2026-08-27T05:08:31.863014+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f2b037a4-f809-48ec-ab8c-f4dae8862aae", "name": "primal-earnest-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 33842, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:07:34.182813+00:00", "ended_at": "2026-08-27T05:07:35.239789+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "69e603b8-d754-40f0-9d4e-a2d6a2f4622f", "name": "courtly-flinty-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 52976, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:06:36.981823+00:00", "ended_at": "2026-08-27T05:06:37.104352+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "56fcbcf7-9c64-43b9-aa4f-26d3d1c45612", "name": "dusky-vigilant-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 46860, "username": "pm", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:05:27.832813+00:00", "ended_at": "2026-08-27T05:05:29.140827+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "0c2b1a2d-af27-40fc-a5a7-eaabe2b24b42", "name": "mottled-thorny-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 50078, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:04:46.558739+00:00", "ended_at": "2026-08-27T05:04:46.816681+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b021830f-905c-4f15-aaf0-3334ea63ea92", "name": "tawny-prairie-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 47140, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:02:56.506500+00:00", "ended_at": "2026-08-27T05:02:56.946844+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1b65979d-eb18-4cb5-9cec-03cfe12605f9", "name": "gentle-autumn-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 49382, "username": "jesus", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:01:37.792100+00:00", "ended_at": "2026-08-27T05:01:39.262764+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "70fa79ba-661e-4929-a96b-99ca5fbbf3ae", "name": "hazy-sterling-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 44238, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T05:01:03.010092+00:00", "ended_at": "2026-08-27T05:01:03.344489+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "687312d7-5371-4627-b413-0afbdc9bee06", "name": "northern-solar-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37344, "username": "scraper", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:59:33.799633+00:00", "ended_at": "2026-08-27T04:59:35.939965+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "921d4b83-ec94-478f-bd97-e733a6dfc27c", "name": "tender-pleasant-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 41324, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:59:12.021336+00:00", "ended_at": "2026-08-27T04:59:12.210763+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "78e0ea51-bf3d-4140-aef5-b3a337317951", "name": "bashful-flinty-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 54336, "username": "stack", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:57:35.146509+00:00", "ended_at": "2026-08-27T04:57:36.073516+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "64d4a328-933d-4e21-b014-8bd82876d455", "name": "feral-spirited-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 38408, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:57:19.136527+00:00", "ended_at": "2026-08-27T04:57:19.419073+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "971a3b3e-d54d-467a-ac5b-7c6cfedfcf79", "name": "ivory-sturdy-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 52080, "username": "mehdi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:55:40.603586+00:00", "ended_at": "2026-08-27T04:55:41.994966+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "8cdfc0bc-3b39-45fc-9e1c-edcbd6edc969", "name": "arctic-idle-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 35486, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:55:22.504364+00:00", "ended_at": "2026-08-27T04:55:22.755255+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0625676f-e8b6-45ee-8c12-575b162587e3", "name": "courtly-fringed-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 39868, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:53:40.033002+00:00", "ended_at": "2026-08-27T04:53:41.077618+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "fb38d34b-df5d-47f8-9fc9-085e285849bf", "name": "drifting-shaded-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 60764, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:53:23.980401+00:00", "ended_at": "2026-08-27T04:53:24.381520+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b7a65124-2460-4337-9d44-8de2fa829983", "name": "austere-brazen-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 38690, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:51:35.348477+00:00", "ended_at": "2026-08-27T04:51:37.531776+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2231 }, { "id": "e7814b32-eb84-4fd2-aa98-60897ddc816e", "name": "zealous-canny-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 57836, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:51:21.367488+00:00", "ended_at": "2026-08-27T04:51:21.917564+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6605346a-8a20-4279-a7a3-5fd74ee2e6f4", "name": "curious-ashen-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37838, "username": "sammy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:49:31.561384+00:00", "ended_at": "2026-08-27T04:49:32.739291+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2225 }, { "id": "8a44f1e9-c3c6-4b0c-923d-a205c3ef9fc6", "name": "fleeting-pristine-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 54876, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:49:14.896325+00:00", "ended_at": "2026-08-27T04:49:15.672073+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "99818851-7ea4-4d62-913b-65273d776767", "name": "barren-airy-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42160, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:47:24.670832+00:00", "ended_at": "2026-08-27T04:47:26.373253+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "118dee24-85e4-4453-967a-68c1b51c952f", "name": "balmy-marbled-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 51932, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:47:20.478481+00:00", "ended_at": "2026-08-27T04:47:20.630927+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8d1d44ba-d548-40c2-9bff-c2694f2ca2bd", "name": "dapper-windswept-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 43532, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:45:24.577959+00:00", "ended_at": "2026-08-27T04:45:25.818090+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "5d2f347d-0292-46bc-aba6-5d5423f59cc1", "name": "smooth-quiet-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 48934, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:45:22.272937+00:00", "ended_at": "2026-08-27T04:45:22.509150+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8712e8ca-65c1-4d9c-a9a6-0f37a32a77e2", "name": "sullen-lofty-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 39404, "username": "abdullah", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:43:27.970027+00:00", "ended_at": "2026-08-27T04:43:29.456538+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2185 }, { "id": "fe58c12f-962e-40fe-bca5-55eac4989b2c", "name": "placid-lonesome-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 45992, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:43:26.539546+00:00", "ended_at": "2026-08-27T04:43:26.745904+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ce2cbbb4-72fd-470e-8f3d-299ad9602594", "name": "dapper-ancient-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 43020, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:41:27.031150+00:00", "ended_at": "2026-08-27T04:41:27.143015+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ae3bef40-401d-4101-a77c-049085b2d196", "name": "emerald-shifting-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 48990, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:41:26.191133+00:00", "ended_at": "2026-08-27T04:41:27.762207+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2227 }, { "id": "17c42d62-88e2-4d36-8230-abac266f69db", "name": "wandering-woven-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 40090, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:39:28.484127+00:00", "ended_at": "2026-08-27T04:39:28.811010+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2de09614-ad33-4341-acc9-e9c28fc203dc", "name": "autumn-courtly-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 54804, "username": "gourav", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:39:25.454106+00:00", "ended_at": "2026-08-27T04:39:26.513841+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2163 }, { "id": "d6f04ec6-87c0-42c7-b14e-1da8f0aa42a8", "name": "thawing-murky-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 37132, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:37:26.206550+00:00", "ended_at": "2026-08-27T04:37:26.883742+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "402eea8c-7073-41a2-912e-007c524242f6", "name": "orderly-thawing-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 56234, "username": "soporte", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:37:20.979229+00:00", "ended_at": "2026-08-27T04:37:22.242100+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2155 }, { "id": "65f25afb-20da-49ca-9d88-9c5979da70a8", "name": "brave-cunning-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 34176, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:35:21.086778+00:00", "ended_at": "2026-08-27T04:35:21.555583+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "81aba5a5-1868-45cf-ba64-b52f1dc6eb5f", "name": "umber-frank-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 56734, "username": "Test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 315, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:35:18.529512+00:00", "ended_at": "2026-08-27T04:35:19.542165+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2137 }, { "id": "d0fffd95-c3ac-4554-a3be-d1305d041c03", "name": "gentle-lively-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 59440, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:33:20.448487+00:00", "ended_at": "2026-08-27T04:33:20.619505+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "797f7ea9-5551-4773-934f-068e502d14c2", "name": "frugal-dusty-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 48826, "username": "miner", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:33:19.591657+00:00", "ended_at": "2026-08-27T04:33:21.856561+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2131 }, { "id": "9e90a36e-8ad2-413c-9459-9fd848fb95bf", "name": "fearless-sleepy-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 53292, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:31:21.052647+00:00", "ended_at": "2026-08-27T04:31:23.085115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "e330f1c0-4221-4025-a922-1fc28ee159ad", "name": "foggy-sunlit-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 56478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:31:15.406157+00:00", "ended_at": "2026-08-27T04:31:15.591224+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "339b0e76-ec1c-4cdd-80ff-9dafa1e94441", "name": "plucky-frosty-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 60444, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:29:19.102327+00:00", "ended_at": "2026-08-27T04:29:20.501614+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2114 }, { "id": "768fab50-efa8-4d4e-b633-0a642a71cde7", "name": "dusty-rambling-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 53494, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:29:07.402685+00:00", "ended_at": "2026-08-27T04:29:07.523203+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "90ab820f-1e5d-45ff-9df5-91cbf696428e", "name": "russet-painted-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42302, "username": "toor", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:27:20.981649+00:00", "ended_at": "2026-08-27T04:27:22.191785+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2091 }, { "id": "712e374d-ad5b-4fa9-94f0-6047a62aca36", "name": "murky-wiry-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 50526, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:26:58.939108+00:00", "ended_at": "2026-08-27T04:26:59.574316+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f481d93a-a18e-4bc4-9505-49c6d36c05ab", "name": "leafy-pleasant-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:25:16.264465+00:00", "ended_at": "2026-08-27T04:25:17.694392+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2139 }, { "id": "4fc7c7e2-bfc8-4913-8636-304975842047", "name": "prairie-grumpy-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 47554, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:24:59.536593+00:00", "ended_at": "2026-08-27T04:24:59.826844+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3b82f935-58b4-461b-8637-633ea35adf0f", "name": "faded-frank-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 40502, "username": "gmodserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:23:23.131226+00:00", "ended_at": "2026-08-27T04:23:24.387253+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2077 }, { "id": "0d42f6cd-ed45-4ec1-9bcf-162521a96664", "name": "plush-plucky-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 44586, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:22:56.399726+00:00", "ended_at": "2026-08-27T04:22:56.614404+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "221d8468-d0a0-4f2d-8126-e9513be867c6", "name": "kindly-forlorn-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 59978, "username": "code", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:21:16.854318+00:00", "ended_at": "2026-08-27T04:21:17.950029+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2066 }, { "id": "723e68a6-aa14-4b6e-b2c4-66eb059a85b1", "name": "dutiful-icy-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 41598, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:20:59.920863+00:00", "ended_at": "2026-08-27T04:21:00.097770+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a1bab6d0-ccb3-46ea-bc7e-612c4bdb60c7", "name": "somber-balmy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 33976, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:19:17.948751+00:00", "ended_at": "2026-08-27T04:19:18.567224+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2106 }, { "id": "bf6575f5-ba8f-4f3a-80b4-696dd9ad24af", "name": "scarlet-burly-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 38630, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:18:49.835661+00:00", "ended_at": "2026-08-27T04:18:50.039049+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d207bb49-94c5-406c-a2ea-1fe6e42bf6fd", "name": "idle-snowy-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 54904, "username": "ray", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:17:19.072824+00:00", "ended_at": "2026-08-27T04:17:19.676348+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2035 }, { "id": "af31a1f6-d84c-49e4-8900-ba2ed680af25", "name": "plush-austere-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 35598, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:16:38.343176+00:00", "ended_at": "2026-08-27T04:16:38.514564+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c3fb7600-21d2-4a09-a795-c2c410a4940a", "name": "jagged-coastal-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 60812, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:14:27.463609+00:00", "ended_at": "2026-08-27T04:14:27.924199+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "63a39161-a5e9-4a49-890a-ad671b472e74", "name": "curious-quaint-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 57752, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:12:16.458520+00:00", "ended_at": "2026-08-27T04:12:17.148298+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "acd8ce96-b7fc-4477-aaec-c5ea6098daa2", "name": "wry-orderly-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 54662, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-27T04:10:00.554198+00:00", "ended_at": "2026-08-27T04:10:01.177315+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e315edee-bc96-40df-9314-d274dc6ed22b", "name": "gritty-emerald-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.70.126.245", "src_port": 50283, "username": "root", "client_version": "SSH-2.0-libssh_0.9.5", "auth_attempts": 1, "automation": "bot", "think_ms": 999, "probe_flagged": 0, "exec_command": "uname -a", "started_at": "2026-08-27T03:58:25.659779+00:00", "ended_at": "2026-08-27T03:58:27.147438+00:00", "ended_reason": "exec complete", "commands": 8, "transcript_bytes": 339 }, { "id": "8465b8d3-32bb-4630-9439-ebd5665c52c7", "name": "misty-wiry-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56490, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 162, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:16:36.254166+00:00", "ended_at": "2026-08-27T03:16:39.257641+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "072c2c61-95e7-4319-812f-4cf03f55c18f", "name": "golden-hidden-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56428, "username": "joel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 164, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:16:35.771311+00:00", "ended_at": "2026-08-27T03:16:40.751331+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4d9ab436-49c7-4389-83a4-18d57f5a1950", "name": "merry-keen-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55558, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 166, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:16:18.266253+00:00", "ended_at": "2026-08-27T03:16:20.864840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "131bbaf2-808a-43cd-bdcf-4d2d332a6e17", "name": "plush-crisp-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48362, "username": "localhost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 168, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:16:14.910114+00:00", "ended_at": "2026-08-27T03:16:21.176442+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "eca4dd1b-864b-4475-8a1b-eddb4778cbba", "name": "blunt-prairie-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48306, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 167, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:16:06.528956+00:00", "ended_at": "2026-08-27T03:16:12.371345+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "673fc83b-25ea-48b9-9afc-c52bcb4dce15", "name": "stoic-candid-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55424, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:16:04.162125+00:00", "ended_at": "2026-08-27T03:16:09.934447+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b5314abb-59f0-4900-bbcf-159701ad13de", "name": "sooty-feathered-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51642, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:48.415803+00:00", "ended_at": "2026-08-27T03:15:54.400737+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bea6f738-b3fd-4439-b5c1-bcb4522bf320", "name": "brisk-leafy-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56728, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:46.487548+00:00", "ended_at": "2026-08-27T03:15:50.873398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a28ae4fd-9e00-4921-8ae2-eb02d0db64a4", "name": "solar-nameless-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51660, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:46.080934+00:00", "ended_at": "2026-08-27T03:15:51.431772+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f4c43f5-4f7d-4e97-af6b-54c536478e42", "name": "pleasant-brisk-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38452, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:36.538872+00:00", "ended_at": "2026-08-27T03:15:39.878406+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c7a16e83-cbaa-443f-912e-82c1799f89aa", "name": "nimble-nameless-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38400, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 382, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:28.493557+00:00", "ended_at": "2026-08-27T03:15:32.596063+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "77ca5840-52af-43a0-9b39-bfe62daa9c3f", "name": "lanky-sunlit-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41178, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:15.954228+00:00", "ended_at": "2026-08-27T03:15:20.748085+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b84e42db-4989-4c19-b951-4aa941682214", "name": "silent-hardy-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35052, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:11.973221+00:00", "ended_at": "2026-08-27T03:15:17.947709+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c70930f6-dd8c-4ad5-af79-c76e8e9d88b0", "name": "vivid-rambling-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34970, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:15:09.309856+00:00", "ended_at": "2026-08-27T03:15:13.769873+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "360c5bdf-cc17-4db1-8672-84c1fbe288aa", "name": "plush-fabled-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60378, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:55.112511+00:00", "ended_at": "2026-08-27T03:15:00.167596+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "98541fa5-680f-4267-8631-728a091a51f9", "name": "frosty-glacial-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43000, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:52.037798+00:00", "ended_at": "2026-08-27T03:14:57.969069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff6c802a-a7a8-4fef-8fe8-04bf24d4496a", "name": "tangled-coral-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42486, "username": "core", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 273, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:48.580060+00:00", "ended_at": "2026-08-27T03:14:54.868956+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "f51fdd4e-bad9-4efd-85bd-fb41e839f212", "name": "meadow-thrifty-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38576, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:38.904777+00:00", "ended_at": "2026-08-27T03:14:44.865489+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5cfbeddf-9a54-4d07-b6fa-604cc4be1b30", "name": "solemn-quiet-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:38.878182+00:00", "ended_at": "2026-08-27T03:14:42.485873+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7f6bfcdd-611f-4d5b-8c9a-9f3f6d536aaa", "name": "sleepy-rustic-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42408, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:21.696858+00:00", "ended_at": "2026-08-27T03:14:26.224393+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d74a0ba3-aaf5-4451-86d9-e3074ab0ce11", "name": "vigilant-sooty-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47902, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:19.724043+00:00", "ended_at": "2026-08-27T03:14:22.755711+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3a3c434-99a2-4bd2-a046-80208265bc34", "name": "smooth-boreal-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48916, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:08.388102+00:00", "ended_at": "2026-08-27T03:14:14.245561+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49cd9559-a33b-48a3-828e-e34dbdf8c0ec", "name": "brazen-ashen-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41000, "username": "grid", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 407, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:08.001163+00:00", "ended_at": "2026-08-27T03:14:15.820560+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2ff2c324-2b8a-451e-947d-cb1a2170f2fd", "name": "lanky-dusty-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48870, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:14:03.802486+00:00", "ended_at": "2026-08-27T03:14:08.142027+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff391039-4ad4-42f4-8198-8bbd4bdef91a", "name": "lunar-fringed-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41492, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:51.801314+00:00", "ended_at": "2026-08-27T03:13:55.971351+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f789ff7-fb01-4fbd-b7e7-35459a1d0287", "name": "coral-blunt-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44908, "username": "kevin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 430, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:47.735746+00:00", "ended_at": "2026-08-27T03:13:53.056519+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b7031b66-7c8c-48e2-82f6-ea23c6f313b9", "name": "northern-frosty-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44974, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:42.287219+00:00", "ended_at": "2026-08-27T03:13:48.274624+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9783a0ca-6248-4bec-a975-1e4f684dfc18", "name": "thawing-airy-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34294, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:39.918894+00:00", "ended_at": "2026-08-27T03:13:47.653738+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "e4c361ab-4721-4ce4-8520-3143c419c102", "name": "restless-quiet-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34358, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 389, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:36.640582+00:00", "ended_at": "2026-08-27T03:13:41.289570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf3d708a-2611-4e46-b929-40f25520f707", "name": "hollow-flinty-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60320, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 369, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:21.162674+00:00", "ended_at": "2026-08-27T03:13:30.243498+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e1fc3ae1-dfa6-44b9-aac0-9e0d09c4039e", "name": "vaulted-fleeting-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35798, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:13.735691+00:00", "ended_at": "2026-08-27T03:13:18.772630+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "598a26bf-a322-4dc9-94f6-b53e10aa89cd", "name": "tidal-tangled-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60246, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 324, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:01.463580+00:00", "ended_at": "2026-08-27T03:13:04.494018+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d9f4bdd-7930-468a-9caf-bcb80db854a3", "name": "plucky-forlorn-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41436, "username": "nutanix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:13:00.061136+00:00", "ended_at": "2026-08-27T03:13:06.844618+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "bd10d9b0-ea11-43fe-9b2c-7cc6a742548d", "name": "velvet-icy-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41486, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:57.563844+00:00", "ended_at": "2026-08-27T03:13:03.220380+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41c80758-f2a4-45cb-bd48-454e7aaa513d", "name": "boreal-hardy-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34216, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:55.070839+00:00", "ended_at": "2026-08-27T03:13:01.007010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07873675-c8e0-4237-9cee-91902640ee28", "name": "stormy-deft-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33878, "username": "ghost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:49.939727+00:00", "ended_at": "2026-08-27T03:12:58.023451+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "2141a7cf-7a47-4665-8256-e1abc9fc17fd", "name": "rugged-airy-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55802, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 382, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:32.580195+00:00", "ended_at": "2026-08-27T03:12:35.511173+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "57dcf377-da76-42ac-ae54-ccbd78bc8409", "name": "woven-thrifty-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55698, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 408, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:27.920473+00:00", "ended_at": "2026-08-27T03:12:32.120704+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "909b0ec0-aad1-4983-91c4-51808b35a7d0", "name": "hushed-crystal-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51338, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:25.054800+00:00", "ended_at": "2026-08-27T03:12:31.487212+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "b5163985-2e66-46e2-9cee-9ab7600ee9a2", "name": "sandy-quiet-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50838, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:12.169952+00:00", "ended_at": "2026-08-27T03:12:15.867243+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "094c28ac-45b6-4584-a5cf-052e6d96a41f", "name": "cosmic-murky-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44698, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:12:01.336522+00:00", "ended_at": "2026-08-27T03:12:07.294850+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fa1568be-eb2d-45fb-9e70-383548895a2d", "name": "nameless-faded-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52292, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:59.423501+00:00", "ended_at": "2026-08-27T03:12:07.681302+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "38bfac82-ffda-482f-a924-56d2b0818e24", "name": "reedy-gnarled-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44640, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:58.872657+00:00", "ended_at": "2026-08-27T03:12:03.926099+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b2adb49a-325b-47f5-9273-364ee9734597", "name": "dapper-wiry-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55320, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:43.593246+00:00", "ended_at": "2026-08-27T03:11:49.274090+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01987180-2500-4398-9d18-13f21216d66a", "name": "granite-autumn-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34920, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:33.370824+00:00", "ended_at": "2026-08-27T03:11:39.745300+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1a4cbc16-debe-4494-9959-82e1c887e98f", "name": "windswept-muted-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55260, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:32.893396+00:00", "ended_at": "2026-08-27T03:11:38.891322+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "822abb2e-950d-49e6-8af2-958958913dc2", "name": "restless-tidal-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57664, "username": "botuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:31.576924+00:00", "ended_at": "2026-08-27T03:11:38.010276+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "ee60ca3b-482e-4fd6-a35c-3180463c302c", "name": "quiet-scarlet-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33184, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:18.834944+00:00", "ended_at": "2026-08-27T03:11:21.651910+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dcbde4c1-927e-4f91-aff2-99f8a3eeff14", "name": "bitter-cheerful-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57618, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:16.157248+00:00", "ended_at": "2026-08-27T03:11:20.690176+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5802bb6c-2bfb-477d-979b-446e456f3085", "name": "civil-upland-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46376, "username": "liyang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:11:04.246696+00:00", "ended_at": "2026-08-27T03:11:13.080691+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5531d1f4-4ae0-4882-b90a-ee45724daa62", "name": "solemn-humble-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46440, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:59.705901+00:00", "ended_at": "2026-08-27T03:11:04.280487+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30fd9b80-7998-45f7-8eae-b4638db5021b", "name": "mossy-umber-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38664, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:51.373992+00:00", "ended_at": "2026-08-27T03:10:55.173294+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "147c4d43-d748-46cc-ab15-52e1fb043649", "name": "seaward-weathered-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38606, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 495, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:46.407146+00:00", "ended_at": "2026-08-27T03:10:52.562607+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d939b128-e9e4-41e9-9911-efef096d2136", "name": "coral-salty-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51044, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:44.414147+00:00", "ended_at": "2026-08-27T03:10:48.398301+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4b0cd96-c34c-4bd5-a091-55a31d76f922", "name": "hazel-feathered-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55414, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:38.317844+00:00", "ended_at": "2026-08-27T03:10:42.912729+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fdfb26f7-cb01-48cd-b1d4-0485c3f56b9e", "name": "flinty-patient-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38072, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:29.656331+00:00", "ended_at": "2026-08-27T03:10:32.997172+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "210d266a-9748-4e75-a5f1-4f476c3ad0bc", "name": "merry-jovial-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38016, "username": "vyos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 473, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:29.283217+00:00", "ended_at": "2026-08-27T03:10:40.667339+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a2505e34-57f1-4125-ba90-5853764885f2", "name": "alpine-civil-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55358, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:24.300724+00:00", "ended_at": "2026-08-27T03:10:29.267342+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7f56b95-3031-4b47-9106-127e655c78fc", "name": "grassy-courtly-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48976, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:10:08.872708+00:00", "ended_at": "2026-08-27T03:10:12.544253+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd0569c7-eb7c-47b5-b4af-005bc04f4795", "name": "faded-fierce-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38994, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:58.991098+00:00", "ended_at": "2026-08-27T03:10:03.329566+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "98891e71-0fc7-40e8-b891-4e3159ca1e80", "name": "patient-emerald-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38894, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 207, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:58.839131+00:00", "ended_at": "2026-08-27T03:10:04.516261+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "246d2746-d73e-4918-9717-0c1fb1865ad2", "name": "marbled-serene-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47072, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:55.695500+00:00", "ended_at": "2026-08-27T03:10:00.280198+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4742aea8-b6d0-4967-8f64-05e5928044a5", "name": "early-buoyant-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40230, "username": "mohammad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:47.675469+00:00", "ended_at": "2026-08-27T03:09:54.044304+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "124fc5a0-ab53-4521-8907-cfe5dd01f820", "name": "frugal-bitter-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47030, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:45.822786+00:00", "ended_at": "2026-08-27T03:09:49.141699+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3507efe3-17a4-40e2-815a-2b76b36bf31b", "name": "glassy-pristine-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40162, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:32.962220+00:00", "ended_at": "2026-08-27T03:09:37.151168+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6bfa274d-4a22-4cce-a9e1-190b764b9405", "name": "marine-quartz-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50908, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:32.445321+00:00", "ended_at": "2026-08-27T03:09:37.439610+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a997f451-bc7c-40a1-b187-1662fdaabba7", "name": "thawing-mighty-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47958, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:21.869795+00:00", "ended_at": "2026-08-27T03:09:25.183903+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da7e72fc-acd5-4565-bb94-7b378117a67e", "name": "dewy-crimson-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57232, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:10.632130+00:00", "ended_at": "2026-08-27T03:09:14.344914+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce0da0ed-6bfa-44f1-af54-2ab9b9d401a5", "name": "genial-thorny-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57194, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:09:00.117534+00:00", "ended_at": "2026-08-27T03:09:05.994238+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "62519c50-129c-49e8-a83d-8b0a4cda6c5b", "name": "solar-fabled-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41866, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:59.921359+00:00", "ended_at": "2026-08-27T03:09:04.963212+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d408ff4-e0ea-422c-a296-a9e55e7e6bed", "name": "shifting-early-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58280, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:53.230686+00:00", "ended_at": "2026-08-27T03:08:58.252374+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c118c60-a1d6-4fdb-9428-81a6e48f7c1e", "name": "placid-windswept-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43262, "username": "config", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:45.040816+00:00", "ended_at": "2026-08-27T03:08:51.198485+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "053adf7e-97d1-4f8e-9eaa-06d2952fcd5a", "name": "shaded-creaky-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58250, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:44.750922+00:00", "ended_at": "2026-08-27T03:08:48.950166+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d484a114-604b-43ff-83e3-4baf34922eb4", "name": "marbled-peaty-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43344, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:41.732935+00:00", "ended_at": "2026-08-27T03:08:47.324560+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad66c903-19f8-4b74-98ad-1cb06d82498f", "name": "wry-oaken-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33244, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:35.638683+00:00", "ended_at": "2026-08-27T03:08:40.948667+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f02ca5b5-07cd-4458-be31-0df841fb7bc4", "name": "quartz-thrifty-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46118, "username": "almalinux", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:34.735067+00:00", "ended_at": "2026-08-27T03:08:42.397144+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "e459aab7-715e-4c52-b6dd-107de585f86b", "name": "primal-mindful-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33190, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:27.564637+00:00", "ended_at": "2026-08-27T03:08:33.595280+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d6b24936-2d79-42ae-8af9-b5ab002599ae", "name": "courtly-brave-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46122, "username": "drcomadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:17.231218+00:00", "ended_at": "2026-08-27T03:08:27.581999+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "4bce6f4b-47d9-46df-a9b2-b845e8e44343", "name": "ruddy-wry-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46092, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:14.744791+00:00", "ended_at": "2026-08-27T03:08:20.505791+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a91b7c18-2dcf-4d20-a45d-dee66bfa721a", "name": "candid-fabled-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56272, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:08:05.075417+00:00", "ended_at": "2026-08-27T03:08:08.371406+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "20d9b2fa-0b3d-4b95-912e-fff636656b14", "name": "frosty-gleaming-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56218, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:58.895828+00:00", "ended_at": "2026-08-27T03:08:03.896453+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "205f287d-5e1f-47be-be0d-4117fc39faeb", "name": "alpine-hazy-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33958, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:54.799600+00:00", "ended_at": "2026-08-27T03:08:00.379402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "83036a95-cc21-4998-9943-79d781f8cf17", "name": "bitter-mellow-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33882, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:47.653735+00:00", "ended_at": "2026-08-27T03:07:50.939413+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5c60626b-aea4-4bc8-9bb9-5c44fda2f193", "name": "chilly-shaded-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50546, "username": "tempuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:40.436587+00:00", "ended_at": "2026-08-27T03:07:45.372815+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ac934ecd-c44a-4527-b6bc-a6f1dcdc6257", "name": "jaunty-faded-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39632, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:35.296876+00:00", "ended_at": "2026-08-27T03:07:39.464259+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "76e32eb3-b85a-4082-970b-1d0369a3da5c", "name": "bashful-graceful-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50496, "username": "hummingbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:33.254817+00:00", "ended_at": "2026-08-27T03:07:41.259503+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "9ae7200d-fc8b-427a-b99a-70c1a07a768e", "name": "wistful-vernal-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34848, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:24.345241+00:00", "ended_at": "2026-08-27T03:07:29.983224+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "978d1ddc-3f49-4c34-bf04-4238fc7a9f9f", "name": "amiable-brave-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34812, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:15.844849+00:00", "ended_at": "2026-08-27T03:07:20.928353+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "854a063b-9078-4913-9676-d539ea7ce5f2", "name": "glacial-plucky-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57518, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:10.147123+00:00", "ended_at": "2026-08-27T03:07:15.168743+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "190ce66b-85a1-4954-b95a-51a6e35f4a28", "name": "ginger-thawing-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53138, "username": "vbox", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:10.125448+00:00", "ended_at": "2026-08-27T03:07:15.230771+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8dcea0dd-e88c-4267-ad6a-372dd770a409", "name": "umber-frosty-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53190, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:07:00.621794+00:00", "ended_at": "2026-08-27T03:07:05.715719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5364761f-9471-4b55-a67f-6fe71ae6c813", "name": "blithe-placid-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57474, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:59.964264+00:00", "ended_at": "2026-08-27T03:07:02.796397+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "02a51130-2ade-4b85-9131-3953b1925a45", "name": "lively-civil-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47576, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:46.128454+00:00", "ended_at": "2026-08-27T03:06:51.331128+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db090501-336c-46c9-a14c-2d8eea5d258a", "name": "frugal-serene-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47544, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:45.424587+00:00", "ended_at": "2026-08-27T03:06:49.987682+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3fc33666-18ed-4f8a-88ef-8b0eb2812f30", "name": "mellow-genial-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41290, "username": "fahmi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 180, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:33.138039+00:00", "ended_at": "2026-08-27T03:06:40.700034+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "8862977c-05d2-4335-8885-88263329a75e", "name": "brave-northern-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54864, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:31.674781+00:00", "ended_at": "2026-08-27T03:06:35.366913+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ead68ce-bea6-4a65-ab53-54ac4f28a5d6", "name": "inland-dapper-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53110, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:30.732574+00:00", "ended_at": "2026-08-27T03:06:35.267818+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1783f83e-f82a-48f4-9a45-1f23cb248e1e", "name": "verdant-tranquil-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53078, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:30.523471+00:00", "ended_at": "2026-08-27T03:06:35.861006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d600129-8f6f-4344-966f-c72c55edcde8", "name": "rambling-humble-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41218, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:15.430020+00:00", "ended_at": "2026-08-27T03:06:20.842405+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8ec169b2-4bcf-43d9-a214-cac6c390b461", "name": "frank-downy-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34404, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:10.178700+00:00", "ended_at": "2026-08-27T03:06:15.190156+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c7e771b-bd0f-4857-b10c-31d107c82ed3", "name": "supple-russet-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54810, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:06:08.632875+00:00", "ended_at": "2026-08-27T03:06:13.416132+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3e8665aa-5d1d-48f6-8802-284fe050ab44", "name": "regal-languid-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54738, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:59.144174+00:00", "ended_at": "2026-08-27T03:06:02.658050+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c10d4f2f-11db-41e2-af8c-9906e0b5ce63", "name": "feral-cosmic-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51178, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:52.334433+00:00", "ended_at": "2026-08-27T03:05:55.684092+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee1924a3-0127-4237-8fc7-ad5878f4242e", "name": "sandy-regal-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35716, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:41.839178+00:00", "ended_at": "2026-08-27T03:05:45.300661+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2199f60f-e5bc-4714-af89-141bdd6ac9f2", "name": "proud-misty-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35694, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:40.763763+00:00", "ended_at": "2026-08-27T03:05:46.560001+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7db800d0-167a-47dd-8d3c-18a499398c8c", "name": "crimson-crisp-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36586, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 428, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:30.234521+00:00", "ended_at": "2026-08-27T03:05:34.065720+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7067abbf-8d31-471e-bfc9-7c6664066656", "name": "lunar-rustic-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55880, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:20.287140+00:00", "ended_at": "2026-08-27T03:05:25.749272+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "16145ddd-4872-4c4c-89df-de6151d0d6c7", "name": "crystal-autumn-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39134, "username": "calvin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:18.632195+00:00", "ended_at": "2026-08-27T03:05:25.943226+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "bc611f47-f7ae-4b1f-86f1-b6691c6903af", "name": "ashen-distant-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55792, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:15.088587+00:00", "ended_at": "2026-08-27T03:05:20.352645+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "87910df0-afc0-43d9-a1c9-122af4512651", "name": "hollow-western-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56504, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:05.544875+00:00", "ended_at": "2026-08-27T03:05:10.508578+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "436cb19a-b7bb-494c-80d4-aca4f59b88f9", "name": "eager-blunt-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39068, "username": "niaoyun", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 269, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:04.446948+00:00", "ended_at": "2026-08-27T03:05:14.732317+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "dbdf8f2a-8cb8-48f7-b3fb-5e3f1cfaa58e", "name": "smoky-scarlet-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56436, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:05:03.546199+00:00", "ended_at": "2026-08-27T03:05:09.476661+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2d46daf-4cfb-44fc-b004-ba9c43a685ad", "name": "honest-brave-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34940, "username": "erpnext", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:56.533515+00:00", "ended_at": "2026-08-27T03:05:05.691245+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "39889bea-0fbe-4f76-b9d4-3de7c0c3a4e7", "name": "faded-zealous-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59720, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:51.905180+00:00", "ended_at": "2026-08-27T03:04:57.909182+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae6ceffe-03bb-4cc6-ac62-4abc64f92eaf", "name": "ancient-serene-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34882, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:35.479492+00:00", "ended_at": "2026-08-27T03:04:39.659831+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f32ecbc-5491-4931-b4ab-496f39f5c695", "name": "plush-forlorn-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39756, "username": "fivem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:35.440164+00:00", "ended_at": "2026-08-27T03:04:39.184715+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "23747b60-cbc5-4dde-ac61-b47e348b03fe", "name": "fabled-mottled-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49558, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:32.685971+00:00", "ended_at": "2026-08-27T03:04:35.909221+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e0d28b6-b4bd-4340-b982-c64573107da2", "name": "patient-bold-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49534, "username": "recorder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:32.628086+00:00", "ended_at": "2026-08-27T03:04:40.960734+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "a5f8d828-a2ea-406c-91ed-904f3d9180ef", "name": "tidal-mighty-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43958, "username": "default", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:19.670599+00:00", "ended_at": "2026-08-27T03:04:25.409426+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "a1759a47-e738-43c3-a737-08b18e0d5bde", "name": "feral-silent-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39702, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:13.810395+00:00", "ended_at": "2026-08-27T03:04:18.128998+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad1c4e0b-4c54-417f-9bf8-c77a19d62954", "name": "fleeting-gnarled-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:04:00.111737+00:00", "ended_at": "2026-08-27T03:04:05.484485+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "965db939-4087-49ba-be5a-930329df5b0b", "name": "gleaming-daring-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38922, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:54.978700+00:00", "ended_at": "2026-08-27T03:03:58.113855+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c701fed0-4548-4fe0-a782-90c994c0e23a", "name": "fleeting-snowy-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38798, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:50.819281+00:00", "ended_at": "2026-08-27T03:03:57.704270+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6eafec67-0087-42ba-8af6-206a19124789", "name": "frosty-frugal-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51262, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:49.902832+00:00", "ended_at": "2026-08-27T03:03:53.421141+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "60ed9ab7-38ed-411f-bbf5-57d012cac1d5", "name": "lawful-thrifty-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51184, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 396, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:41.256679+00:00", "ended_at": "2026-08-27T03:03:44.334569+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "17e48f33-6e73-4825-a0dc-97ebe0509713", "name": "lively-frugal-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42460, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:39.231906+00:00", "ended_at": "2026-08-27T03:03:42.152745+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "96f43e14-5319-44b6-baf5-d7681a3a14fd", "name": "candid-clever-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42388, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:32.956842+00:00", "ended_at": "2026-08-27T03:03:37.321015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4797a1c3-82f6-4869-88d5-25bd51810c27", "name": "inland-nimble-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46630, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:20.152619+00:00", "ended_at": "2026-08-27T03:03:26.422252+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a1af637b-56a9-442e-8562-3a9aca908d49", "name": "nautical-thrifty-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46590, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:19.775702+00:00", "ended_at": "2026-08-27T03:03:23.283861+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "000cc196-eea2-4872-998f-ca8560e81895", "name": "civil-fickle-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59358, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 431, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:12.137635+00:00", "ended_at": "2026-08-27T03:03:17.503238+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fbd2bbf0-2ee9-4be8-bfd2-4a95ceeca3a2", "name": "sterling-pleasant-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59260, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:03.167494+00:00", "ended_at": "2026-08-27T03:03:09.129172+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b49ea42-ef7c-4030-b154-5e6c0a92e99b", "name": "civil-sturdy-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56366, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:03:00.155781+00:00", "ended_at": "2026-08-27T03:03:04.861926+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01420f38-7078-4dd8-8bcd-0b1cac1cfe54", "name": "sooty-murky-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44096, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:56.234121+00:00", "ended_at": "2026-08-27T03:02:59.319884+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9aa59f74-258e-401b-8971-718724bf4120", "name": "gnarled-loyal-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44044, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:44.325244+00:00", "ended_at": "2026-08-27T03:02:49.081488+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5deb6649-41ff-4713-8473-10203aa182e6", "name": "painted-solemn-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46032, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:41.891302+00:00", "ended_at": "2026-08-27T03:02:44.620441+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f41c890f-e705-41eb-9a31-20cc510a3d83", "name": "plucky-lofty-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46954, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:35.491815+00:00", "ended_at": "2026-08-27T03:02:40.361468+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f9b6d59-11c6-4f0e-9b30-dbfbbb266b7e", "name": "oaken-seaward-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50316, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:23.157945+00:00", "ended_at": "2026-08-27T03:02:29.288910+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f858ef5d-ad30-4e05-8f10-6f800a8eeeea", "name": "ruddy-nameless-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46912, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:22.889498+00:00", "ended_at": "2026-08-27T03:02:26.293495+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0f2fb6d-6893-403f-ac33-6ad0181c8d0f", "name": "twilight-barren-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50258, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:14.330993+00:00", "ended_at": "2026-08-27T03:02:17.660173+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d600dab-a314-4eeb-8164-747a8872b0c8", "name": "orderly-gloomy-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44566, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 390, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:06.244250+00:00", "ended_at": "2026-08-27T03:02:10.541013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a3f9079-b90d-4644-b266-e57122984415", "name": "sturdy-seaward-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34312, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 354, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:02:04.590016+00:00", "ended_at": "2026-08-27T03:02:10.532281+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da2a392e-7bad-484f-8974-9300f47eab6f", "name": "electric-hollow-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34262, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:58.694796+00:00", "ended_at": "2026-08-27T03:02:01.928894+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2259d629-c020-48bb-aab8-ad0503f9874b", "name": "crystal-marbled-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34314, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:54.530413+00:00", "ended_at": "2026-08-27T03:02:00.206808+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c176240f-4f1c-4041-9c22-5f8490eb5b0b", "name": "proud-silent-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55106, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 370, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:44.866082+00:00", "ended_at": "2026-08-27T03:01:48.371506+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b815134f-fbfd-40da-8a55-650e3edefe9f", "name": "dewy-ruddy-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55144, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:44.617302+00:00", "ended_at": "2026-08-27T03:01:48.821267+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0bb16e03-cfb1-4817-8665-b245caabc272", "name": "brazen-idle-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40926, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:32.689966+00:00", "ended_at": "2026-08-27T03:01:38.734094+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c9a4ba0-471a-40c8-9ca8-7b1c540c0ecb", "name": "early-feral-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40892, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:27.904038+00:00", "ended_at": "2026-08-27T03:01:33.195123+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d30e20ff-1588-45c6-8c5f-22ae50f45949", "name": "prickly-twilight-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42638, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 305, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:23.477446+00:00", "ended_at": "2026-08-27T03:01:29.153544+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb253e79-e4dd-461d-9e6a-05cc11991bd9", "name": "zealous-watchful-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60508, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:20.773118+00:00", "ended_at": "2026-08-27T03:01:26.668346+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5a29a98d-2601-4516-92c0-34ed196732f5", "name": "rapid-gentle-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60390, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:06.907038+00:00", "ended_at": "2026-08-27T03:01:12.167426+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba073567-d8dc-451d-9dd4-70dbd973bcbc", "name": "cobalt-shaded-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52330, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 423, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:01:06.324995+00:00", "ended_at": "2026-08-27T03:01:09.061907+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0be2e39a-d8e0-4a11-a637-51948d9db9a1", "name": "painted-knotted-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44144, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:51.538254+00:00", "ended_at": "2026-08-27T03:00:56.563794+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac7f6a6b-5865-402d-859b-3c556ea1ac3f", "name": "bashful-weathered-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52610, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:51.377737+00:00", "ended_at": "2026-08-27T03:00:54.270490+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "66d98385-25e2-46c8-8506-a3fe63c0614b", "name": "electric-wandering-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44068, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:46.742429+00:00", "ended_at": "2026-08-27T03:00:51.117709+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b5cf5de7-ea65-4d4e-a690-176b58bf379c", "name": "polar-crimson-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52546, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 310, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:38.134671+00:00", "ended_at": "2026-08-27T03:00:41.244428+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e453a09-c9d1-49c7-9a4c-b6db74fb5046", "name": "ruddy-graceful-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33062, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:28.447642+00:00", "ended_at": "2026-08-27T03:00:31.937614+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd2617f5-0e76-40ab-9b55-1e9b879099fc", "name": "forlorn-prickly-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40848, "username": "Asalem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:23.636940+00:00", "ended_at": "2026-08-27T03:00:32.561579+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "deb956b9-35c1-4399-b68b-7560a0d386b6", "name": "mottled-glassy-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41276, "username": "wizard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:15.031651+00:00", "ended_at": "2026-08-27T03:00:21.638771+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "35151245-03ed-4299-b915-b4f2763e50d0", "name": "graceful-grumpy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36082, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:03.200814+00:00", "ended_at": "2026-08-27T03:00:09.228047+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b54ca70-11fa-4dca-ac20-66582ac29304", "name": "vigilant-tender-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36046, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T03:00:01.672707+00:00", "ended_at": "2026-08-27T03:00:06.876888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d64063a-37f4-4b89-9dc0-aaf8b720b185", "name": "downy-autumn-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59362, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:57.480834+00:00", "ended_at": "2026-08-27T03:00:02.160958+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "54be3456-af50-49e6-be6f-546e4c70c759", "name": "velvet-restless-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59320, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:54.451925+00:00", "ended_at": "2026-08-27T02:59:59.768673+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0c1b6fa-ea0d-48b4-8cd6-e684e7002525", "name": "dutiful-regal-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57822, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:42.751826+00:00", "ended_at": "2026-08-27T02:59:46.704953+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c1f47a0c-4d11-4a07-a843-b94b4fa367c6", "name": "rapid-inland-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36256, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:33.359077+00:00", "ended_at": "2026-08-27T02:59:38.734047+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5c15fbf4-ea53-4da6-8f23-a671bcd57663", "name": "gallant-dusty-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37178, "username": "airflow", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:31.742332+00:00", "ended_at": "2026-08-27T02:59:38.440022+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "5690b06f-1809-4364-a0f3-81fdb9d3b316", "name": "dusky-earnest-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45832, "username": "amine", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:28.316855+00:00", "ended_at": "2026-08-27T02:59:37.288169+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b5414917-14fc-46ed-9285-5fbf3ff9345f", "name": "solemn-wooded-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37124, "username": "system", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:26.289322+00:00", "ended_at": "2026-08-27T02:59:33.757869+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f448776d-5d3b-4d36-b33d-544f4b20a898", "name": "wandering-breezy-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36152, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:24.707346+00:00", "ended_at": "2026-08-27T02:59:29.533431+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5521ca84-95e0-441e-8924-fad9fd4701df", "name": "reedy-gnarled-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38310, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:59:09.192796+00:00", "ended_at": "2026-08-27T02:59:14.549115+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3934e2b3-2cad-42ee-915c-7191a236f6ca", "name": "glacial-stoic-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57370, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:56.123131+00:00", "ended_at": "2026-08-27T02:59:00.765924+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bc7ba66-15d1-423b-93da-5c94594aed45", "name": "prickly-thrifty-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38260, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:55.272940+00:00", "ended_at": "2026-08-27T02:59:01.128527+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba9a5ef9-e542-4a4b-a07b-6f5b342c5322", "name": "nameless-mighty-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53150, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:39.849033+00:00", "ended_at": "2026-08-27T02:58:44.996229+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa5772ba-4495-4f74-8285-1931da8666b8", "name": "windswept-obsidian-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57354, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:39.240930+00:00", "ended_at": "2026-08-27T02:58:42.440546+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c8bf8a6-ead3-48e7-a2de-e5f19e1553fc", "name": "snowy-nautical-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55062, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:36.001915+00:00", "ended_at": "2026-08-27T02:58:39.456006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba39f45c-6e42-4192-90e7-ac09a5de5c84", "name": "stoic-quartz-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54938, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 273, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:27.627093+00:00", "ended_at": "2026-08-27T02:58:32.448553+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cc225a81-7c08-4ffc-8898-08cfd7239376", "name": "umber-noble-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51102, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:24.839334+00:00", "ended_at": "2026-08-27T02:58:30.558048+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7cffe3e9-4105-4144-b2c5-1fe6be942d58", "name": "cosmic-crimson-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58012, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:11.405356+00:00", "ended_at": "2026-08-27T02:58:16.532465+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9d5aaa33-ddf9-4d9d-8d1d-40d7d7213724", "name": "wandering-clever-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49340, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:08.349630+00:00", "ended_at": "2026-08-27T02:58:13.447511+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "50c5021e-c143-4ab2-817a-0ec95203f84f", "name": "inland-frank-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49288, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 431, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:58:02.876036+00:00", "ended_at": "2026-08-27T02:58:08.804376+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c7b21c5b-e277-4471-808c-65033e6bccb5", "name": "western-emerald-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44912, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:49.413502+00:00", "ended_at": "2026-08-27T02:57:53.328700+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e449c8cb-5ed3-4d12-833a-5cfde24481fb", "name": "lucid-deft-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34676, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:40.816866+00:00", "ended_at": "2026-08-27T02:57:45.554063+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4cafd81-34e9-4869-aa20-f9751e63320a", "name": "muted-vivid-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34626, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:40.605494+00:00", "ended_at": "2026-08-27T02:57:44.594629+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8962c436-dc99-4b0c-9e07-0d9420165f11", "name": "curious-craggy-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54108, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:32.516508+00:00", "ended_at": "2026-08-27T02:57:37.984114+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f58ca360-8133-4fcd-bdcd-42e1c92812fe", "name": "balmy-leafy-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59044, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:30.747795+00:00", "ended_at": "2026-08-27T02:57:39.245944+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "01d74881-d0a0-47cf-84f5-cf5ff6ab804c", "name": "mottled-keen-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54062, "username": "sedu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 381, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:30.684298+00:00", "ended_at": "2026-08-27T02:57:36.233208+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "492a4f68-4a55-4a9d-a7c1-e7734d69c487", "name": "hushed-dappled-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48606, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:14.672947+00:00", "ended_at": "2026-08-27T02:57:17.791917+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e03c0e2-d2a6-4cf1-a9a8-121deb3d1a6b", "name": "russet-prairie-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38178, "username": "tactical", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:08.295372+00:00", "ended_at": "2026-08-27T02:57:15.833777+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "52c3e8e5-9706-41ff-a96d-34ebe2fdf5d8", "name": "civil-graceful-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48570, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:07.328252+00:00", "ended_at": "2026-08-27T02:57:10.406042+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f03177ac-9e66-4a1e-b269-6b0c6794ed00", "name": "civil-barren-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48196, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:57:00.408049+00:00", "ended_at": "2026-08-27T02:57:05.586664+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8369b979-e2bc-406f-ba13-a362fdcb2702", "name": "sturdy-windswept-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38080, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:43.001771+00:00", "ended_at": "2026-08-27T02:56:48.399780+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac83027c-2c3f-4ba6-b125-c6940faa2d3c", "name": "hazy-solemn-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33828, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 366, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:35.919642+00:00", "ended_at": "2026-08-27T02:56:39.968810+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35ba73b3-5bd1-415c-91cb-5b1989959ca3", "name": "seaward-flinty-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56018, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:30.144296+00:00", "ended_at": "2026-08-27T02:56:36.042187+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ffaa519e-ede7-4ef6-97ba-11a6fe1e39c0", "name": "calm-solemn-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55940, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:18.980111+00:00", "ended_at": "2026-08-27T02:56:21.888968+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a4fd1482-0937-443c-b61c-78820424a8c2", "name": "lonesome-lucid-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60806, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:17.197992+00:00", "ended_at": "2026-08-27T02:56:19.849606+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7f9fda61-1fad-465c-bbb9-a1b68004473b", "name": "ivory-pewter-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53948, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:08.262920+00:00", "ended_at": "2026-08-27T02:56:11.240723+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "647e22e2-1c6f-47ff-9f1b-c78b7ce17441", "name": "tender-genial-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45242, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:56:05.682629+00:00", "ended_at": "2026-08-27T02:56:10.202049+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fdf0ef24-d857-4e71-9674-5a3574438e81", "name": "valiant-languid-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56194, "username": "jay", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:59.181812+00:00", "ended_at": "2026-08-27T02:56:06.430591+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "abb978e9-1e39-4668-97a0-32c187b007e3", "name": "gentle-nautical-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53904, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:57.508841+00:00", "ended_at": "2026-08-27T02:56:02.237921+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "075d850b-019e-4f73-9e75-85265c577215", "name": "mighty-gentle-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36566, "username": "kubernetes", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:54.487657+00:00", "ended_at": "2026-08-27T02:56:01.297904+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "b1b1a1be-ea47-4538-b25d-9430fc26cc14", "name": "ruddy-buoyant-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36524, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:35.219758+00:00", "ended_at": "2026-08-27T02:55:41.114542+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "954f1b89-902d-44a4-bdc5-2ad595139433", "name": "austere-proud-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41664, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:28.368225+00:00", "ended_at": "2026-08-27T02:55:31.580479+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e6063c71-2ec1-4ac8-bbed-6ffc3a977e2f", "name": "murky-lanky-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42684, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:17.100150+00:00", "ended_at": "2026-08-27T02:55:20.760505+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "76156313-8725-4454-a052-e75d03cb95b0", "name": "hearty-vivid-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47126, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:15.759126+00:00", "ended_at": "2026-08-27T02:55:19.623315+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae73a45d-dc7b-439a-b361-9ecb57ac17eb", "name": "feathered-jovial-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47070, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 303, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:12.599118+00:00", "ended_at": "2026-08-27T02:55:15.908719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "25a2eebb-e264-48b3-aa96-01f1504486a3", "name": "downy-marine-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58250, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:55:09.229704+00:00", "ended_at": "2026-08-27T02:55:16.198115+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "bc8b0b7b-1a55-4177-a61b-059d3dc1c670", "name": "ancient-sunlit-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 306, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:50.359335+00:00", "ended_at": "2026-08-27T02:54:56.071178+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e3ea957-d9f0-40df-ae6a-f7bd56aaa334", "name": "stoic-jagged-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50434, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 399, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:49.846487+00:00", "ended_at": "2026-08-27T02:54:53.754069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ebcd0b73-23a1-4621-994b-821f06aa59b0", "name": "dewy-jolly-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40800, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:43.504997+00:00", "ended_at": "2026-08-27T02:54:47.202669+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0c5f3da-b97a-4acd-8d92-be6a69608e25", "name": "burly-plucky-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53754, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:36.081615+00:00", "ended_at": "2026-08-27T02:54:39.227023+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06e84c80-f186-41b4-957d-90b0ad5064dc", "name": "umber-downy-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53696, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:32.123598+00:00", "ended_at": "2026-08-27T02:54:36.475323+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73b98a60-4bbd-404f-b592-f2c2c5499339", "name": "wandering-nautical-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44204, "username": "martin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:31.244084+00:00", "ended_at": "2026-08-27T02:54:37.160442+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ced04218-192d-458f-b1cd-c668f25af41c", "name": "tawny-nautical-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44078, "username": "t1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:21.849621+00:00", "ended_at": "2026-08-27T02:54:28.271481+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "85376a51-df34-45d3-8625-c3278aafee68", "name": "shaded-jaunty-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43794, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:11.975080+00:00", "ended_at": "2026-08-27T02:54:19.495352+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ffe590e5-8755-47cc-87cc-d65e1bb8f9e0", "name": "sterling-courtly-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36300, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:54:09.361881+00:00", "ended_at": "2026-08-27T02:54:12.418502+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e509f2e6-f10a-4a27-acc0-dfa692722cbd", "name": "creaky-fickle-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53460, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:55.975257+00:00", "ended_at": "2026-08-27T02:53:58.840363+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c25ce542-aeed-4b72-b981-d821940d3c68", "name": "supple-stoic-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43682, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:54.434522+00:00", "ended_at": "2026-08-27T02:53:58.600246+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cd405267-01a1-4e38-a374-0dc0af03896f", "name": "polar-shaded-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45654, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 340, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:43.032636+00:00", "ended_at": "2026-08-27T02:53:48.513742+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90803ea9-433d-4455-979f-9b383d6c62aa", "name": "jaunty-feathered-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45612, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:34.022857+00:00", "ended_at": "2026-08-27T02:53:38.045315+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a96b4832-7bc1-4a02-9779-a2112b945d53", "name": "breezy-blazing-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41808, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:31.981900+00:00", "ended_at": "2026-08-27T02:53:37.018238+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2e1dbb7-9156-4237-b844-a2e168b48aec", "name": "cunning-vernal-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57720, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 466, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:22.512084+00:00", "ended_at": "2026-08-27T02:53:25.691037+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bc8f3858-65a9-447f-b1c0-a3e9a5d23a24", "name": "scarlet-gritty-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57632, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:13.741988+00:00", "ended_at": "2026-08-27T02:53:19.225596+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9bdaf3ce-2e88-4b5a-9165-b78fb227aec3", "name": "clever-gleaming-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54376, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 437, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:53:04.161134+00:00", "ended_at": "2026-08-27T02:53:08.983693+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f0de8c30-291d-48a1-82ac-27ff219a40ca", "name": "nameless-misty-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37786, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:59.024451+00:00", "ended_at": "2026-08-27T02:53:01.995277+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "64747d6d-3225-465a-a2e9-6d52bda884ff", "name": "hollow-wiry-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48330, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:57.774790+00:00", "ended_at": "2026-08-27T02:53:07.569808+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "527f1b34-a9eb-456d-b6f9-b46867b63bcb", "name": "grumpy-blithe-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37742, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:54.658713+00:00", "ended_at": "2026-08-27T02:52:58.776765+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a305089a-32ff-4093-82fa-3def122abc22", "name": "golden-ashen-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40298, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:45.886086+00:00", "ended_at": "2026-08-27T02:52:49.555618+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "52eafcca-db0b-452a-af46-b231e3123aee", "name": "creaky-pleasant-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48232, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:39.974542+00:00", "ended_at": "2026-08-27T02:52:45.651050+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "64c78e7b-dccf-4e3a-abb4-4549ce25ae79", "name": "mighty-distant-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49924, "username": "angel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:35.278881+00:00", "ended_at": "2026-08-27T02:52:41.355514+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "a3fa15f3-7570-47bc-9e15-dc380b9212f1", "name": "blunt-obsidian-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48310, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:30.882288+00:00", "ended_at": "2026-08-27T02:52:35.027836+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e977c846-687e-44c9-8220-06dbb42da808", "name": "tranquil-fabled-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37606, "username": "webmaster", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:24.739253+00:00", "ended_at": "2026-08-27T02:52:33.743829+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "d30f45b8-e28b-4190-a8f1-a0f43d2a6655", "name": "eager-ruddy-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49800, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:19.980100+00:00", "ended_at": "2026-08-27T02:52:24.972594+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac1dde6f-e75b-4c59-a959-514a6fb7df87", "name": "smooth-ivory-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37530, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:10.012823+00:00", "ended_at": "2026-08-27T02:52:13.567948+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "260d146c-1933-4c3f-aa0c-672e0d722fea", "name": "sandy-burly-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45782, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:52:02.306937+00:00", "ended_at": "2026-08-27T02:52:05.603219+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5644ec97-d882-448a-9216-17798f8aba51", "name": "distant-regal-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33588, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:51.091157+00:00", "ended_at": "2026-08-27T02:51:56.786050+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6d09ba17-a425-4d7c-90b3-923d5ae3d02c", "name": "oaken-grumpy-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45198, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 366, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:44.246219+00:00", "ended_at": "2026-08-27T02:51:48.358097+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "625fef39-7678-4982-8752-9489e3478a6e", "name": "stoic-genial-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45158, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:38.499892+00:00", "ended_at": "2026-08-27T02:51:42.471840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed74de36-0ef0-44b8-8571-97c44e3b2ab7", "name": "noble-twilight-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40536, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:29.252320+00:00", "ended_at": "2026-08-27T02:51:38.325901+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "87174f21-1fa4-4a7a-a8b6-5ee2240dd0e5", "name": "spirited-wistful-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60178, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:29.160810+00:00", "ended_at": "2026-08-27T02:51:32.714298+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f9d9b1df-1903-4ffa-9314-f9d547cb4bad", "name": "freckled-prickly-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40510, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:17.063512+00:00", "ended_at": "2026-08-27T02:51:20.782229+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bb048cb8-2bc5-4117-b90f-617cba5582fe", "name": "misty-dewy-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51202, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:09.132389+00:00", "ended_at": "2026-08-27T02:51:14.204310+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "930c1867-3c95-425b-a39b-913cd85ffa52", "name": "sandy-shifting-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33592, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:05.342896+00:00", "ended_at": "2026-08-27T02:51:10.067509+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e004cae-4fd5-45da-aed5-fea060736fc3", "name": "gloomy-glacial-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 471, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:51:00.950083+00:00", "ended_at": "2026-08-27T02:51:05.857167+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5260efbd-4491-4915-b2dc-23d420609df7", "name": "subtle-shifting-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44058, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:55.469346+00:00", "ended_at": "2026-08-27T02:51:03.341377+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "257788ba-1cff-48a4-a9d8-4e63132dce7d", "name": "crimson-courtly-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46432, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:49.628241+00:00", "ended_at": "2026-08-27T02:50:54.862216+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "14f9577b-1e65-45a1-9961-1e26e2b106dd", "name": "civil-glacial-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43990, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:38.005608+00:00", "ended_at": "2026-08-27T02:50:42.092830+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3e273d00-6611-47a1-818a-2d544b84b67d", "name": "bitter-creaky-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50358, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 404, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:31.551083+00:00", "ended_at": "2026-08-27T02:50:35.207242+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01fbbd40-baad-432a-b2cb-1a5f28789af0", "name": "jagged-frank-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54010, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:28.505065+00:00", "ended_at": "2026-08-27T02:50:34.081232+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "355ea2c5-ce0d-4af1-915c-4d723749b952", "name": "placid-fringed-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53988, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:19.170196+00:00", "ended_at": "2026-08-27T02:50:24.057545+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8bd5933b-4047-49e6-9d80-bb181d770ba7", "name": "gleaming-tawny-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50786, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:12.351080+00:00", "ended_at": "2026-08-27T02:50:15.606618+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7cd888f4-d7c0-46b0-9fa5-ed519fb27a83", "name": "loyal-quiet-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55594, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:50:05.782609+00:00", "ended_at": "2026-08-27T02:50:09.549307+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "91963856-7acb-4bf2-8ac3-1c29660ec5a8", "name": "primal-ruddy-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40412, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:59.025888+00:00", "ended_at": "2026-08-27T02:50:04.982648+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf4670f3-3a05-49eb-8544-84fa977c83fd", "name": "vigilant-slender-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55498, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:56.967113+00:00", "ended_at": "2026-08-27T02:50:01.652308+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c997b46a-3177-413b-a11a-90d90947bc3e", "name": "fringed-silent-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40362, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:47.095990+00:00", "ended_at": "2026-08-27T02:49:49.901479+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce546907-e616-495e-b534-563d960cebbf", "name": "rambling-indigo-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35494, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:39.220766+00:00", "ended_at": "2026-08-27T02:49:44.441100+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d85429dd-af81-4fbb-b3aa-62376d24f5cf", "name": "feathered-gentle-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43902, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:28.103566+00:00", "ended_at": "2026-08-27T02:49:32.882350+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fb38d5a4-08ff-4a07-a3d9-c8e2e24c112a", "name": "smoky-hazy-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40552, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:27.197909+00:00", "ended_at": "2026-08-27T02:49:30.602054+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cdfb7ecc-e5ac-4d6b-a642-95b997c38474", "name": "oaken-cheerful-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40448, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:15.805198+00:00", "ended_at": "2026-08-27T02:49:18.718297+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c949e219-d6a8-4e67-bc1a-3a07b54696e2", "name": "glacial-prairie-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50508, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:08.173710+00:00", "ended_at": "2026-08-27T02:49:13.111379+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3cd5f02b-5a8c-428e-9907-ef449bfebd70", "name": "sullen-stormy-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55140, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:49:05.372109+00:00", "ended_at": "2026-08-27T02:49:09.325700+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69749926-a55d-4c7a-9855-2521e25f0f86", "name": "hidden-quaint-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38474, "username": "customer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 433, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:57.258881+00:00", "ended_at": "2026-08-27T02:49:04.627259+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "211fa1ab-7c73-4d8e-87a5-9664047a181c", "name": "daring-distant-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38516, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:52.639797+00:00", "ended_at": "2026-08-27T02:48:57.839308+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "87e94acc-6f43-4862-adf7-885210d047b5", "name": "pleasant-calm-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37884, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:40.677183+00:00", "ended_at": "2026-08-27T02:48:45.043367+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e587c24-b3c7-404a-b252-7d19bce2495d", "name": "freckled-russet-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37972, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:39.383356+00:00", "ended_at": "2026-08-27T02:48:44.517846+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3bf6ceaa-a23d-413e-88ae-6f72484f20df", "name": "knotted-tawny-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39464, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 441, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:35.532695+00:00", "ended_at": "2026-08-27T02:48:40.036938+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "486dbf04-d9b2-4823-a647-035218977c5a", "name": "zealous-valiant-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39330, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 433, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:33.975147+00:00", "ended_at": "2026-08-27T02:48:40.621930+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "9d4a7ff1-0db4-48c4-9a67-be4ea4202c4c", "name": "candid-alpine-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49644, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 342, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:21.875282+00:00", "ended_at": "2026-08-27T02:48:26.373517+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "727ddc7f-7e23-46fe-91bf-85391541e625", "name": "mossy-inland-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54044, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:19.004903+00:00", "ended_at": "2026-08-27T02:48:22.878884+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8255f6b6-ac93-4f29-8c95-c6d12536f31f", "name": "orderly-crisp-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53964, "username": "potok", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:14.976882+00:00", "ended_at": "2026-08-27T02:48:22.835327+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "43658f77-ce2f-48c3-8d7b-988826ec23a1", "name": "frugal-freckled-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53424, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:48:02.768426+00:00", "ended_at": "2026-08-27T02:48:08.009599+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31c9b484-9c6d-41b2-8eb8-ed39fe47481c", "name": "verdant-dapper-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53354, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:57.344695+00:00", "ended_at": "2026-08-27T02:48:01.196562+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f51c47b5-6bb6-46f7-97e8-70696de44899", "name": "rapid-thawing-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41246, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:46.693359+00:00", "ended_at": "2026-08-27T02:47:51.163349+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b9ffe46a-b1b5-488c-89ed-388f4c914f2e", "name": "loyal-mellow-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52730, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:41.841072+00:00", "ended_at": "2026-08-27T02:47:44.692852+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f193e7f-00ee-4841-8eef-61699b3e71ea", "name": "emerald-brave-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52678, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:35.072178+00:00", "ended_at": "2026-08-27T02:47:38.782487+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "914d8a40-4373-4598-9568-a714002596e3", "name": "sincere-daring-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40056, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:29.921780+00:00", "ended_at": "2026-08-27T02:47:35.057577+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f45b68fe-843c-4220-9df8-c0a0a5af5a06", "name": "restless-stoic-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50562, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:26.776359+00:00", "ended_at": "2026-08-27T02:47:31.829262+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "371ba7f8-0f72-4119-b2e9-8246f9a3a520", "name": "arctic-drifting-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50494, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:22.823744+00:00", "ended_at": "2026-08-27T02:47:27.420654+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2a34994b-281f-4c23-bd9c-0867a57ab12c", "name": "marbled-freckled-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37060, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 273, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:16.363425+00:00", "ended_at": "2026-08-27T02:47:22.164637+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f8b83317-1f24-4ba8-bfca-56b69fe0229c", "name": "tender-watchful-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37034, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:13.119215+00:00", "ended_at": "2026-08-27T02:47:16.380745+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e710007-aeae-4f00-ae50-088a9c72bb9b", "name": "bronzed-twilight-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57184, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:47:05.392805+00:00", "ended_at": "2026-08-27T02:47:10.303193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a586cd34-29f7-4fda-942a-60c96ba01d20", "name": "lucid-sandy-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41872, "username": "service", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:59.882622+00:00", "ended_at": "2026-08-27T02:47:08.597417+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "939f4590-a5df-42eb-b93a-19f07f71e3bb", "name": "faded-crystal-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46658, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:52.203779+00:00", "ended_at": "2026-08-27T02:46:58.949202+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a0c023be-ab8f-4fe5-aa9d-b4fbd07891fb", "name": "scarlet-plucky-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41806, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:48.913842+00:00", "ended_at": "2026-08-27T02:46:54.953116+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41c662e8-4a12-47df-848f-74c0ebe57697", "name": "mighty-dusky-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46596, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:34.070545+00:00", "ended_at": "2026-08-27T02:46:39.021440+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8bca99f0-d395-4d5b-ba4a-db1518e6020e", "name": "reedy-ginger-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56842, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:31.573126+00:00", "ended_at": "2026-08-27T02:46:35.126408+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1b9df431-baad-4bb2-8345-623246ed2469", "name": "keen-diligent-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56814, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:30.656886+00:00", "ended_at": "2026-08-27T02:46:36.505356+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7d54356a-749b-4e62-9a2d-59557a9cfeba", "name": "crisp-upland-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47974, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:25.186235+00:00", "ended_at": "2026-08-27T02:46:29.726156+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78dbe475-4f65-48e7-a3cf-9ccab0507c09", "name": "tender-zealous-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52520, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 473, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:10.282450+00:00", "ended_at": "2026-08-27T02:46:13.974607+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e6fc620-ee17-4be3-a726-02c090115a3e", "name": "austere-patient-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60168, "username": "zlm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:04.672528+00:00", "ended_at": "2026-08-27T02:46:11.187630+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "938aeab0-781d-44f2-a749-0351de8a51e1", "name": "lunar-sunlit-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60214, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 370, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:46:04.466914+00:00", "ended_at": "2026-08-27T02:46:08.444417+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2a01ceda-630f-4e2d-b099-634b14e3fed6", "name": "sleepy-smoky-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43336, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 427, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:59.100022+00:00", "ended_at": "2026-08-27T02:46:05.058258+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf1e23b2-ee1b-4d33-b1bd-fef9505c83f6", "name": "oaken-peaty-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54020, "username": "parsa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 485, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:52.121325+00:00", "ended_at": "2026-08-27T02:46:00.211381+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "4b7059b7-9313-408d-b126-9022a4a2682d", "name": "wooded-mottled-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54072, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:44.273226+00:00", "ended_at": "2026-08-27T02:45:47.414166+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ced3484-ca41-4bb3-ab85-931bb4e85257", "name": "lawful-gleaming-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 605, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:33.849655+00:00", "ended_at": "2026-08-27T02:45:37.095132+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7ef384ac-60ed-44d9-ae47-69fef161fac4", "name": "somber-pewter-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57190, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 423, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:29.986596+00:00", "ended_at": "2026-08-27T02:45:34.502648+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e14dd366-dd76-486d-b256-c58fa634b604", "name": "hidden-placid-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48306, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 465, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:27.189497+00:00", "ended_at": "2026-08-27T02:45:33.089297+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb139597-01c7-4a7f-977c-cd65b24ce8be", "name": "seaward-pleasant-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40890, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:23.091989+00:00", "ended_at": "2026-08-27T02:45:28.347304+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51509014-84e6-4250-8307-7e27b7d15942", "name": "fringed-buoyant-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38466, "username": "kali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:13.276871+00:00", "ended_at": "2026-08-27T02:45:16.255811+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f030d6a2-9371-49a7-a319-f87203af173f", "name": "zealous-indigo-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38440, "username": "ftpuser1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 492, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:11.541353+00:00", "ended_at": "2026-08-27T02:45:22.656993+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "940f4440-7273-4972-b331-bcc27c0d6aea", "name": "tranquil-lunar-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40870, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:45:10.523669+00:00", "ended_at": "2026-08-27T02:45:14.489711+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bb5f733e-9c4e-47e8-9b69-c1ea0b05b016", "name": "ancient-sunlit-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35988, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:53.809904+00:00", "ended_at": "2026-08-27T02:45:02.260742+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "179d2785-7ead-41b5-9574-03270b7d535c", "name": "mindful-marbled-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36060, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:49.976578+00:00", "ended_at": "2026-08-27T02:44:52.786769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3180a100-7f1f-4d78-9e02-186bf1f0ff67", "name": "woven-stoic-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42036, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:37.134465+00:00", "ended_at": "2026-08-27T02:44:41.597881+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b6b9b75-2a6e-438d-9c0b-b3b86adbd0fa", "name": "vivid-plucky-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47362, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:27.055067+00:00", "ended_at": "2026-08-27T02:44:30.422639+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "27515e63-ed62-4f92-a060-96c00c5d8486", "name": "nameless-foggy-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47304, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 385, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:24.515315+00:00", "ended_at": "2026-08-27T02:44:27.820198+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d811079-6990-4a4c-9106-9a161da541e0", "name": "honest-supple-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53820, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:12.948564+00:00", "ended_at": "2026-08-27T02:44:17.281870+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e59567d8-e191-4a8e-93c5-c95529aaa7e1", "name": "merry-restless-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51056, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 366, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:12.834632+00:00", "ended_at": "2026-08-27T02:44:18.530554+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e7a6978-38ba-4c9a-a09f-98ec1a60aa1f", "name": "wistful-ginger-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53708, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:44:06.049311+00:00", "ended_at": "2026-08-27T02:44:11.060402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ec752188-fc3d-4782-93aa-4c52db5c7339", "name": "muted-vivid-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54858, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:55.916184+00:00", "ended_at": "2026-08-27T02:44:01.373236+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8f01816-7dee-40e1-ada8-0adbde1efdaf", "name": "oaken-lofty-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53518, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 337, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:54.967203+00:00", "ended_at": "2026-08-27T02:43:58.244354+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d4863ae-950a-4570-baef-fb22b39b440f", "name": "velvet-northern-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43402, "username": "codex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:50.626087+00:00", "ended_at": "2026-08-27T02:43:57.402662+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "5ea3532b-cd4b-4b9f-bd31-c6d89c3c7051", "name": "crystal-knotted-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43336, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:41.374840+00:00", "ended_at": "2026-08-27T02:43:46.471416+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e974c3db-3fd7-4cd0-ba98-d3f7cba3c161", "name": "merry-scarlet-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39398, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:37.533965+00:00", "ended_at": "2026-08-27T02:43:44.022282+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "57fa0e65-1b70-4f8f-9dee-35de61dc2691", "name": "fierce-hollow-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60702, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:31.228580+00:00", "ended_at": "2026-08-27T02:43:34.056225+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4117791d-7161-4e25-bcb0-faad45496f04", "name": "slender-stoic-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39322, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:16.113895+00:00", "ended_at": "2026-08-27T02:43:19.648001+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3985147-ba8b-465f-a2f3-a4e0fe642f0a", "name": "lanky-ginger-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57328, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:11.835055+00:00", "ended_at": "2026-08-27T02:43:15.069220+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9da4f82b-5572-4572-a5ae-4351db890d57", "name": "snowy-hushed-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57356, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:07.769775+00:00", "ended_at": "2026-08-27T02:43:11.342339+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92b2824c-c52d-4df3-8adf-aa597f98d9df", "name": "marine-blithe-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:43:01.576121+00:00", "ended_at": "2026-08-27T02:43:07.212366+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "55e91234-396d-4f32-acff-c14ee463720a", "name": "eager-somber-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52376, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:51.815739+00:00", "ended_at": "2026-08-27T02:42:54.516207+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb81c999-03f2-4de1-95c1-9339a22b2e7d", "name": "sterling-quiet-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52280, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:47.836107+00:00", "ended_at": "2026-08-27T02:42:51.393230+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8f6236f0-ca0a-4338-9bcc-0a16332a2ac8", "name": "nimble-hushed-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51852, "username": "kafka", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:44.682882+00:00", "ended_at": "2026-08-27T02:42:50.462229+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "57c97805-7534-4b14-b1d7-46f7c0a8c358", "name": "deft-plush-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 53642, "username": "ts", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 565, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:42:38.067078+00:00", "ended_at": "2026-08-27T02:42:39.177391+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "502de4f2-5e65-41b3-b5d6-484b1e5a3436", "name": "frosty-gentle-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51776, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 423, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:36.949249+00:00", "ended_at": "2026-08-27T02:42:42.648026+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03c973a9-2eef-4dfb-8ec6-f159c092f51d", "name": "shaded-candid-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39920, "username": "gns3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:30.262001+00:00", "ended_at": "2026-08-27T02:42:40.281079+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4328a23d-6c32-49dc-acb6-97da825da524", "name": "weathered-gleaming-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45558, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:25.146501+00:00", "ended_at": "2026-08-27T02:42:30.603235+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c504b7ef-fa2d-44ff-961f-d451310df45e", "name": "balmy-verdant-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53292, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:13.969217+00:00", "ended_at": "2026-08-27T02:42:19.918177+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ecffce4-0981-439c-b757-aff5824794f9", "name": "wandering-hazy-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:11.048175+00:00", "ended_at": "2026-08-27T02:42:14.046863+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b8d1191d-97d3-4661-90e8-56c307a75cf9", "name": "idle-shifting-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37432, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:42:01.870844+00:00", "ended_at": "2026-08-27T02:42:07.376808+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9deade89-962f-41bd-bf2a-7d57a91d4ad3", "name": "gilded-glacial-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37330, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:49.956057+00:00", "ended_at": "2026-08-27T02:41:54.847010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8dc18c8e-0f31-4096-b4fc-46c0bdd031b8", "name": "eager-hollow-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55660, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:44.481539+00:00", "ended_at": "2026-08-27T02:41:50.371140+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4fe361bc-8b87-4a93-8119-6b2a724ad512", "name": "clever-sunlit-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60934, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:43.601266+00:00", "ended_at": "2026-08-27T02:41:47.440834+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8159f8dd-6fcb-4434-b08d-b3dd83bea7e6", "name": "fringed-salty-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39942, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:39.624618+00:00", "ended_at": "2026-08-27T02:41:43.204464+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "94ffa720-d6c3-4f3e-bcd7-f9b1832fa332", "name": "cosmic-hazy-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44590, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:21.917003+00:00", "ended_at": "2026-08-27T02:41:27.419391+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35546b4a-28de-483a-8708-84b5294b2331", "name": "fringed-feathered-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 410, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:20.494011+00:00", "ended_at": "2026-08-27T02:41:25.370228+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "333c5cbf-53bb-45c9-aaec-f192cf366d8c", "name": "cheerful-obsidian-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39618, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:12.892876+00:00", "ended_at": "2026-08-27T02:41:18.924237+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cd0918c0-4416-48fd-94d6-c493bf63eaf9", "name": "crimson-valiant-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42908, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:04.743133+00:00", "ended_at": "2026-08-27T02:41:09.439312+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4271c35-b51c-43de-9128-4817a810bd1f", "name": "knotted-ivory-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47600, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 273, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:04.284784+00:00", "ended_at": "2026-08-27T02:41:13.251632+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "031ae997-cb14-4ee5-8d17-dcbfb2856060", "name": "rapid-velvet-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39544, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:41:04.080600+00:00", "ended_at": "2026-08-27T02:41:09.715726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a681204e-2673-455b-b422-22a4a806c939", "name": "golden-emerald-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47520, "username": "term2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 305, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:57.240053+00:00", "ended_at": "2026-08-27T02:41:06.420000+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "3e7c3b2d-399e-494e-a32e-0cc7373abc6f", "name": "autumn-fierce-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58048, "username": "user4", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:49.021941+00:00", "ended_at": "2026-08-27T02:40:56.894023+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "1cbfb953-bc4c-4697-a701-74ceb2307dc2", "name": "russet-dusty-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57998, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 315, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:30.854271+00:00", "ended_at": "2026-08-27T02:40:36.632990+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3687f263-de54-4efd-a5ec-9a645a1b949b", "name": "lucid-orderly-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38540, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:30.587050+00:00", "ended_at": "2026-08-27T02:40:35.813819+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "076c37cb-ab52-459f-8c3c-d7fb5914c734", "name": "granite-leafy-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38438, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:23.819115+00:00", "ended_at": "2026-08-27T02:40:27.428897+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a5bc4cac-4e98-4adf-a6ee-aab7504fc6ed", "name": "graceful-diligent-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47846, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:18.931399+00:00", "ended_at": "2026-08-27T02:40:22.457311+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e28cfb54-dce2-4db9-b9bf-056889c5aca0", "name": "shifting-honest-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45022, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:14.298496+00:00", "ended_at": "2026-08-27T02:40:18.116548+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "252403aa-8b19-4cff-a746-dcf29507f053", "name": "sturdy-crystal-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44954, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:40:06.669716+00:00", "ended_at": "2026-08-27T02:40:12.108050+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c5bcbe48-b5d2-45b6-860e-d010c5b31b4b", "name": "sterling-feathered-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33532, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:55.183693+00:00", "ended_at": "2026-08-27T02:40:00.138819+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f386c258-2ac3-4e54-983d-d1423d9dbc1d", "name": "proud-frosty-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:53.722062+00:00", "ended_at": "2026-08-27T02:39:57.779808+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a545b970-32f1-4e0e-85ab-0c77670c5f1e", "name": "vigilant-honest-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47828, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:48.898723+00:00", "ended_at": "2026-08-27T02:39:51.742709+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "46099ea4-c07b-431c-9b2b-0751ed500934", "name": "nautical-frugal-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43068, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:38.962397+00:00", "ended_at": "2026-08-27T02:39:41.963608+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2510945-ae02-49f5-bc33-a2058b7853a2", "name": "mindful-brave-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34558, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:35.744958+00:00", "ended_at": "2026-08-27T02:39:38.812600+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7f5a4ba8-4925-4947-9c9d-397140e25ac5", "name": "steady-gilded-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 60868, "username": "zyx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:39:29.692683+00:00", "ended_at": "2026-08-27T02:39:31.389472+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "5d54db19-dc32-456e-9afe-c0341e18e34e", "name": "orderly-bronzed-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52872, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:25.949338+00:00", "ended_at": "2026-08-27T02:39:31.175225+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49e46ce3-962f-45cb-88f3-584f2f15271b", "name": "icy-blithe-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33094, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:18.772942+00:00", "ended_at": "2026-08-27T02:39:25.444010+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "bd0d7739-37bc-4378-85d6-7d9adc7860a4", "name": "leafy-bold-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34490, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:18.142754+00:00", "ended_at": "2026-08-27T02:39:23.210291+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5442e2d4-d42a-4240-ac33-43188f4c5869", "name": "keen-restless-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52846, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:16.592651+00:00", "ended_at": "2026-08-27T02:39:21.142197+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51ccb885-139a-468e-a1af-91ac280ddefd", "name": "verdant-courtly-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48136, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:09.030095+00:00", "ended_at": "2026-08-27T02:39:15.801707+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "49b0cf2e-5bf6-40cd-a146-56936e925e3f", "name": "shaded-ivory-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54906, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:39:04.888838+00:00", "ended_at": "2026-08-27T02:39:10.954173+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "459b73ae-89ce-4ff2-b89d-122455c1d9ac", "name": "amiable-primal-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48046, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:57.900535+00:00", "ended_at": "2026-08-27T02:39:00.743844+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e16173a9-9fc0-41cc-86e8-b8861a3f5692", "name": "crimson-brisk-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51396, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:47.924057+00:00", "ended_at": "2026-08-27T02:38:53.689934+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d95136e4-2dfc-4359-9ae4-f784de3f6470", "name": "airy-dutiful-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35718, "username": "orange", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:41.892719+00:00", "ended_at": "2026-08-27T02:38:48.495724+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3b3613c3-dc69-48dd-9ce3-58a2ab596382", "name": "cobalt-sterling-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51284, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:36.017498+00:00", "ended_at": "2026-08-27T02:38:41.357661+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6eb57d4b-da97-4de0-8f83-f70db9f7e43c", "name": "lively-feathered-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55568, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 306, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:33.333391+00:00", "ended_at": "2026-08-27T02:38:40.480304+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "fa702796-34a3-4cd5-bb67-a364ba22d0b6", "name": "jolly-lawful-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35672, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:26.385575+00:00", "ended_at": "2026-08-27T02:38:30.569590+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "16f12cf5-ee5c-40a4-90c6-e7b9800e887e", "name": "wiry-lofty-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55514, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:13.552771+00:00", "ended_at": "2026-08-27T02:38:18.537429+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "731b9399-4baa-454a-8cc5-6f415f52b1e3", "name": "inland-vigilant-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57350, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:11.830932+00:00", "ended_at": "2026-08-27T02:38:17.372109+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dcbd2d98-6cc9-4211-8e3a-60121b33683c", "name": "sleepy-marine-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56566, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:38:00.024136+00:00", "ended_at": "2026-08-27T02:38:05.746324+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c91f8bd5-465a-4549-9ed8-08adb0a3ed76", "name": "pewter-slender-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56526, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:59.631023+00:00", "ended_at": "2026-08-27T02:38:04.457487+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04197e36-f657-482a-8d71-f7d2c37a5e89", "name": "whispering-curious-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53182, "username": "super", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:57.411496+00:00", "ended_at": "2026-08-27T02:38:05.222461+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "bc4767ee-4213-4905-8e06-a3310d543a97", "name": "solar-lively-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33858, "username": "hduser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:51.379221+00:00", "ended_at": "2026-08-27T02:37:55.018023+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2c4bdce5-80fa-4480-9dee-b6b842f6ea96", "name": "hardy-barren-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53238, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:49.488194+00:00", "ended_at": "2026-08-27T02:37:54.955370+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "afc8bf40-3db2-459e-b38e-283a6ac0cc4d", "name": "vaulted-mighty-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33796, "username": "ark", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:35.932755+00:00", "ended_at": "2026-08-27T02:37:43.062525+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "7fa4a576-db02-4834-8619-0a949d33fe0e", "name": "windswept-sleepy-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56192, "username": "init", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:27.218222+00:00", "ended_at": "2026-08-27T02:37:33.673873+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "ca2958c1-7040-4c5c-a634-33d742c6d1af", "name": "lunar-lively-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52538, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:20.606355+00:00", "ended_at": "2026-08-27T02:37:24.109453+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fe19b10c-5dce-4daa-8c70-ee24f3dc708a", "name": "whispering-opal-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42218, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:19.575334+00:00", "ended_at": "2026-08-27T02:37:25.680705+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ad0a6ba7-0d80-46f9-b60d-8d1ad3a00f71", "name": "breezy-restless-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52524, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:16.716415+00:00", "ended_at": "2026-08-27T02:37:21.754945+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2bc7bd4e-d66e-4b9d-8584-e2f2ce22445c", "name": "sturdy-obsidian-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42178, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:07.291232+00:00", "ended_at": "2026-08-27T02:37:12.371217+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "57c4e1d6-7ba3-46fc-9350-4f8cdf34b5f0", "name": "weathered-boreal-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37330, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:02.162091+00:00", "ended_at": "2026-08-27T02:37:09.347355+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "10ee5ef2-a2e3-4617-88f4-5803c0946ff1", "name": "humble-cunning-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53912, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:37:01.977680+00:00", "ended_at": "2026-08-27T02:37:06.675502+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3df1f272-a242-497c-a76d-dcf685d48068", "name": "fearless-granite-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37224, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:47.465110+00:00", "ended_at": "2026-08-27T02:36:53.135670+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1a5f896c-ed82-437e-8b46-4f10a2f1b626", "name": "frank-fleeting-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46866, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:40.835763+00:00", "ended_at": "2026-08-27T02:36:45.516471+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9968b58d-0e09-4886-977c-2a2006c6c68b", "name": "cheerful-russet-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46828, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:29.864767+00:00", "ended_at": "2026-08-27T02:36:33.164168+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90cec686-db28-42e1-80d3-c64ef6f688cf", "name": "fleeting-ruddy-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43960, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:24.377028+00:00", "ended_at": "2026-08-27T02:36:29.058459+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e95adf91-7feb-45ba-9937-2e0111842b51", "name": "courtly-cosmic-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49170, "username": "ac", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 532, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:36:22.796549+00:00", "ended_at": "2026-08-27T02:36:23.539081+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "56c3c6bb-d7b7-4b3a-908c-aea660b79148", "name": "orderly-brazen-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60234, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:22.505092+00:00", "ended_at": "2026-08-27T02:36:27.684110+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78206a6f-afb1-4873-8528-0ae38b114e40", "name": "meadow-alpine-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60156, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:20.150331+00:00", "ended_at": "2026-08-27T02:36:23.683059+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01366a3a-89bf-4cdc-93a1-35efe6485512", "name": "gleaming-flinty-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38348, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:06.392438+00:00", "ended_at": "2026-08-27T02:36:12.241934+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8ceebaf-ff03-439f-9ce5-30ecaf37437b", "name": "western-mighty-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38320, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:36:05.503589+00:00", "ended_at": "2026-08-27T02:36:11.153023+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0221c40f-fb57-4f10-8503-23cd4a2237dd", "name": "earnest-nimble-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41154, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:55.329112+00:00", "ended_at": "2026-08-27T02:35:58.550256+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ec8b550-2fc5-43e9-8dd0-003f728c297e", "name": "grassy-valiant-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57046, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:46.484113+00:00", "ended_at": "2026-08-27T02:35:51.472390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10d0a4ab-c51b-43d1-97a9-72e4125e1a6f", "name": "lonesome-grumpy-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56944, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:45.356410+00:00", "ended_at": "2026-08-27T02:35:49.096953+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fe92cb9e-9f78-48f5-975c-e2702963f3db", "name": "sturdy-sandy-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42508, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:39.396505+00:00", "ended_at": "2026-08-27T02:35:44.344001+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a21b3f2-826c-4f25-a75d-c6e116fae10d", "name": "sleepy-rustic-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58292, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:30.030302+00:00", "ended_at": "2026-08-27T02:35:35.979926+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4747cf7-8675-4a72-aa40-a56ddeb2ebc7", "name": "painted-lonesome-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58412, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:30.005695+00:00", "ended_at": "2026-08-27T02:35:35.345096+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce54a8e5-ffb6-4018-89ff-956b2f0e43f4", "name": "amber-nautical-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33768, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:23.038102+00:00", "ended_at": "2026-08-27T02:35:29.203468+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "96bd8af2-d868-46b4-81b4-808433f33e8f", "name": "peaty-barren-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47962, "username": "trade", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:16.938081+00:00", "ended_at": "2026-08-27T02:35:21.455595+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dad25ab4-fad1-4b8a-a00c-978b5a276d7c", "name": "lawful-reedy-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33736, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:12.814687+00:00", "ended_at": "2026-08-27T02:35:16.888413+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "82196143-6633-4671-b6ce-3a44494f44f8", "name": "lucid-noble-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50488, "username": "lucas", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:35:03.580912+00:00", "ended_at": "2026-08-27T02:35:11.741373+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "891ce4bd-ab8b-4eae-85b1-2882a4494a3e", "name": "distant-bashful-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50546, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:58.392371+00:00", "ended_at": "2026-08-27T02:35:03.013554+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "141af61b-dffb-4974-b21e-b00dd6ab250e", "name": "prairie-tangled-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50990, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:46.600428+00:00", "ended_at": "2026-08-27T02:34:49.957689+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8fb258d-789e-4972-8fbc-7841abd8c7e9", "name": "regal-cobalt-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46886, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:43.685146+00:00", "ended_at": "2026-08-27T02:34:46.657282+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35c5fd86-4022-43da-b81d-0dc55cf9dd86", "name": "oaken-orderly-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46934, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:43.205098+00:00", "ended_at": "2026-08-27T02:34:46.454068+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "76b0f995-d771-4b40-9535-ea843a5903f5", "name": "fickle-balmy-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58216, "username": "user3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:36.809553+00:00", "ended_at": "2026-08-27T02:34:40.106207+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "5450877e-42b5-4979-a8ea-3977e7385da8", "name": "plucky-grassy-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48858, "username": "amin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 340, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:36.303111+00:00", "ended_at": "2026-08-27T02:34:42.293443+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "baaa95b2-057c-42ed-b5d2-2b1ee36afa78", "name": "ancient-sunlit-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48802, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:21.537210+00:00", "ended_at": "2026-08-27T02:34:27.154445+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4543342-7037-4a26-b23b-2f56fda9cc51", "name": "valiant-serene-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45042, "username": "ossuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 339, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:14.596907+00:00", "ended_at": "2026-08-27T02:34:20.838503+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1665 }, { "id": "3b1d619f-e26c-4f51-a8c7-08ee394b5d50", "name": "lunar-wry-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48596, "username": "user10", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:13.535413+00:00", "ended_at": "2026-08-27T02:34:18.582419+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "afc75e61-9eff-485d-a165-a7d686694b9c", "name": "sterling-wry-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44938, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:34:08.414892+00:00", "ended_at": "2026-08-27T02:34:14.508573+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7150224-baca-4cdf-afd0-40aa2f763f93", "name": "earnest-tawny-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52936, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:52.356441+00:00", "ended_at": "2026-08-27T02:33:56.981642+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4d23b97-9755-4b9c-9c46-44cba42672da", "name": "downy-pristine-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52994, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:48.288358+00:00", "ended_at": "2026-08-27T02:33:53.909379+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "84ded69b-57f9-43c2-a1ff-709691a264d3", "name": "marbled-painted-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51240, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:43.729969+00:00", "ended_at": "2026-08-27T02:33:48.374888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c7d8f76-68b3-45f5-97e6-14ad50b76c7d", "name": "solemn-subtle-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33692, "username": "playground", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 471, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:36.038962+00:00", "ended_at": "2026-08-27T02:33:46.089237+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "d3c02348-bf6c-4814-bc67-3cda0e7bb619", "name": "jolly-serene-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58970, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:31.743826+00:00", "ended_at": "2026-08-27T02:33:37.539591+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "644ae93a-a02a-41b5-8337-394ddc6f16f0", "name": "russet-courtly-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49912, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:33:20.602582+00:00", "ended_at": "2026-08-27T02:33:21.281889+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8bc2c9e4-f34b-4250-bac9-2cb6085e60b9", "name": "bashful-thorny-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33606, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:13.578162+00:00", "ended_at": "2026-08-27T02:33:18.185250+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed09cc5b-f8d0-4a89-bff1-3b83e1a0d303", "name": "idle-quartz-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46432, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:09.181541+00:00", "ended_at": "2026-08-27T02:33:12.465685+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06872218-6488-49e6-a41d-0f8ae3a3de39", "name": "lawful-bitter-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57078, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 402, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:33:04.287889+00:00", "ended_at": "2026-08-27T02:33:08.844102+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "77b8e169-d1eb-4001-bf49-ab71e1e60dfe", "name": "chilly-murky-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57156, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:56.043128+00:00", "ended_at": "2026-08-27T02:32:58.836456+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "79a39479-d508-4021-8555-5781080918c8", "name": "rapid-ashen-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47798, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:50.736827+00:00", "ended_at": "2026-08-27T02:32:53.599003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ec6ee4bc-e9d6-4668-b979-83ce6e6a6641", "name": "hardy-cunning-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55452, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:46.857362+00:00", "ended_at": "2026-08-27T02:32:51.907726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3e4db24b-f943-47ce-a301-af863495ff61", "name": "shifting-canny-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55368, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:38.225534+00:00", "ended_at": "2026-08-27T02:32:44.159249+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6081f097-202f-4985-aea5-6ce7f0d143c6", "name": "breezy-peaty-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34028, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:34.532026+00:00", "ended_at": "2026-08-27T02:32:41.684381+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "80104383-625e-4325-9c88-3a0872ca5c7b", "name": "curious-orderly-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51124, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:22.043902+00:00", "ended_at": "2026-08-27T02:32:27.833180+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "7473ea66-7b22-4e45-b9b8-ec4975cd25bd", "name": "arctic-ginger-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42984, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:17.272439+00:00", "ended_at": "2026-08-27T02:32:20.613157+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b6ae5e1-c34f-460c-bdc5-952d1a335d96", "name": "whispering-sullen-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51180, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:10.716038+00:00", "ended_at": "2026-08-27T02:32:14.220503+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b56e6d23-5ba2-4435-b15a-e0eef67b1931", "name": "northern-sincere-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39722, "username": "daniel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:32:08.394107+00:00", "ended_at": "2026-08-27T02:32:14.424400+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "dcf61764-b7a5-4ef7-be0a-31105f24d7d4", "name": "sooty-clever-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47566, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:31:49.984497+00:00", "ended_at": "2026-08-27T02:31:54.018901+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3b31691b-cf67-484f-8a98-993486427073", "name": "glacial-vivid-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47550, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:31:38.456549+00:00", "ended_at": "2026-08-27T02:31:46.189583+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "ebb017de-a624-461d-bd72-08f2eccf3b36", "name": "woven-honest-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34656, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:31:22.177515+00:00", "ended_at": "2026-08-27T02:31:28.081571+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c25320d0-f814-4789-a2dc-446342ca4b25", "name": "pleasant-woven-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46948, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:31:02.072878+00:00", "ended_at": "2026-08-27T02:31:03.662901+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "382a33ef-c3a9-4a72-bed8-58f7bc327232", "name": "faded-lawful-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46858, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:55.635440+00:00", "ended_at": "2026-08-27T02:30:57.001965+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30d1a405-0d6a-4390-a01d-f1932582655f", "name": "arctic-snowy-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60536, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:50.619660+00:00", "ended_at": "2026-08-27T02:30:52.770402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1267a712-7ea8-4148-9b05-02533764a3aa", "name": "gritty-gilded-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60482, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:45.664131+00:00", "ended_at": "2026-08-27T02:30:46.621934+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c36241c4-4cb9-49fc-a806-828a7d2da45a", "name": "bronzed-sunlit-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58886, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:38.671775+00:00", "ended_at": "2026-08-27T02:30:40.430717+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "506e2ff1-523a-4735-ad64-6f0d6b87430e", "name": "eager-dewy-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56260, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:33.397561+00:00", "ended_at": "2026-08-27T02:30:34.334010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9fef399-1f58-4646-8275-3724d541972c", "name": "somber-fleeting-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45180, "username": "devuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:28.094673+00:00", "ended_at": "2026-08-27T02:30:33.158117+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "c421ff32-9624-44e4-b890-93b289a7d2c4", "name": "diligent-supple-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45132, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 289, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:19.984555+00:00", "ended_at": "2026-08-27T02:30:22.095085+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d423fca-c1da-4afb-9fd8-c137c0d90b05", "name": "arctic-reedy-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39110, "username": "ivan", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:16.561462+00:00", "ended_at": "2026-08-27T02:30:21.243922+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "78c3c711-6800-486d-aae1-f005b6400818", "name": "bitter-sterling-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39082, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:11.779565+00:00", "ended_at": "2026-08-27T02:30:16.875890+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ec9a9d2c-1655-44fa-99af-6f39b52c9b03", "name": "proud-frank-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41930, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:30:01.187174+00:00", "ended_at": "2026-08-27T02:30:07.085537+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "d4b8204a-adc6-47e3-8abf-58c0f3ea7364", "name": "lunar-steady-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58526, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:29:48.429040+00:00", "ended_at": "2026-08-27T02:29:50.008148+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e16b01e-9d97-4014-9389-d0d6ee5fe6dd", "name": "languid-mighty-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58468, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:29:35.639116+00:00", "ended_at": "2026-08-27T02:29:37.102693+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "224d7ec8-c546-4972-ac66-035b489d0555", "name": "grassy-velvet-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 32864, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:29:30.825652+00:00", "ended_at": "2026-08-27T02:29:31.571070+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5caa8338-6ca2-43a8-b431-786ef952642f", "name": "rustic-upland-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60066, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:29:21.810326+00:00", "ended_at": "2026-08-27T02:29:22.231279+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0f1d4e65-f8eb-4cc3-a33b-8a67009ece93", "name": "granite-arctic-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59976, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:29:13.506095+00:00", "ended_at": "2026-08-27T02:29:14.242189+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09e69ef3-3f80-4c0f-a2cb-1e34e9909168", "name": "knotted-frugal-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55576, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:29:00.169329+00:00", "ended_at": "2026-08-27T02:29:00.250859+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a80974b7-aa69-4443-8241-4a615ce55be0", "name": "idle-merry-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33258, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:28:54.550280+00:00", "ended_at": "2026-08-27T02:28:54.683259+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b012df71-fcae-4901-8475-98e900024789", "name": "burly-airy-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58424, "username": "gg", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:28:46.952116+00:00", "ended_at": "2026-08-27T02:28:51.354106+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "d5229bbe-57e2-42dd-ad33-d47764477e12", "name": "jolly-deft-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55722, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:26.972305+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 4, "transcript_bytes": 239 }, { "id": "2b4f78c0-2f20-4a0d-a423-74c248f51331", "name": "bashful-umber-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40636, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:26.872429+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 3, "transcript_bytes": 220 }, { "id": "404e4ee3-bff9-4a03-a71a-d1d10959b512", "name": "patient-subtle-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44116, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:26.766573+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 13, "transcript_bytes": 1635 }, { "id": "f5451f90-1dc9-47c5-9dcf-0ed8595e9a03", "name": "lofty-subtle-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40668, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:26.700772+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 2, "transcript_bytes": 147 }, { "id": "7995a319-c739-4e31-af60-09cfd59f56a6", "name": "windswept-seaward-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45586, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:26.576118+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 7, "transcript_bytes": 474 }, { "id": "42cb91cb-20f9-4b2c-a094-370fda8216af", "name": "muted-salty-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55682, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:24.684882+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 6, "transcript_bytes": 425 }, { "id": "13af94c3-e09c-4245-a63f-ed8edf4bca09", "name": "prairie-blazing-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60756, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:24.161295+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 9, "transcript_bytes": 664 }, { "id": "0ce8bf6c-9834-4452-93fd-52eb79e2ec1f", "name": "ivory-keen-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60804, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:24.036954+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 9, "transcript_bytes": 664 }, { "id": "d7863bbe-c4e0-4bf2-bb4a-b4d2e76afd8c", "name": "lively-candid-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53224, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:28:23.628562+00:00", "ended_at": "2026-08-27T02:28:30.229016+00:00", "ended_reason": "honeypot reconnected", "commands": 11, "transcript_bytes": 811 }, { "id": "d16db196-7d5c-42d1-aca3-07751c81cb2f", "name": "vigilant-daring-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44016, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:28:13.527259+00:00", "ended_at": "2026-08-27T02:28:17.792015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "61f882c1-2c16-4e5b-a2fe-cf4d9cfb8910", "name": "umber-shifting-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48606, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:28:11.528956+00:00", "ended_at": "2026-08-27T02:28:15.986936+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7d34c5e4-190e-4caf-85db-d99f94be28c1", "name": "shifting-gallant-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38014, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:28:03.514473+00:00", "ended_at": "2026-08-27T02:28:08.351713+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3441b938-4b16-4cdd-b542-56b109b1f230", "name": "brazen-electric-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52852, "username": "cursor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:53.437825+00:00", "ended_at": "2026-08-27T02:27:59.358716+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b3f77095-61e6-4f59-ad26-dd69b7fc0ad7", "name": "coral-earnest-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37938, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:52.600312+00:00", "ended_at": "2026-08-27T02:27:56.562142+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7690f89a-145f-420d-b699-00efda27925c", "name": "vaulted-windswept-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35014, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 283, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:42.679731+00:00", "ended_at": "2026-08-27T02:27:45.654885+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "035b4904-b3cd-4b74-91a6-a67bc8240466", "name": "frugal-fearless-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58730, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:37.549504+00:00", "ended_at": "2026-08-27T02:27:46.646757+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "12ae3236-5424-4c2c-a36d-a6aa81123087", "name": "tangled-hearty-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58624, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 380, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:20.362254+00:00", "ended_at": "2026-08-27T02:27:24.060520+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a24f410d-f961-42c4-b2f6-ebf0be665ff9", "name": "lunar-subtle-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57942, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:18.592532+00:00", "ended_at": "2026-08-27T02:27:21.428576+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ab7c17f-fd4a-4f19-9e20-963f9595e640", "name": "windswept-seaward-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43058, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 473, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:14.905588+00:00", "ended_at": "2026-08-27T02:27:20.657074+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "64c4cea7-e732-426c-9a31-3ab843d2a25d", "name": "glacial-tangled-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42994, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:13.971952+00:00", "ended_at": "2026-08-27T02:27:18.784940+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c1d730f6-0400-4b4e-9eff-4b5a19b1fa25", "name": "flinty-painted-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46178, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:27:03.815102+00:00", "ended_at": "2026-08-27T02:27:07.936727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0d34dad-6286-40f0-9fff-5ff2ffb87d08", "name": "zealous-lawful-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 34832, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:27:02.181397+00:00", "ended_at": "2026-08-27T02:27:03.575059+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d99cdd30-24c6-4085-95bd-17e30e745fb5", "name": "lofty-jaunty-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46440, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 345, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:58.005602+00:00", "ended_at": "2026-08-27T02:27:03.119218+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41b23420-9c51-4c61-8486-eaef051847e8", "name": "windswept-lofty-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46384, "username": "aiuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:56.526557+00:00", "ended_at": "2026-08-27T02:27:03.430287+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a75f71cf-5641-428c-bcc2-96e5bd26437c", "name": "shaded-jagged-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42102, "username": "qw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:52.874935+00:00", "ended_at": "2026-08-27T02:27:01.270687+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "87509961-23b9-4b35-9902-0cebf1870ba7", "name": "thrifty-lanky-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43932, "username": "sdadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 362, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:42.499191+00:00", "ended_at": "2026-08-27T02:26:48.502592+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "41392d31-9584-4aed-abd8-daf6499536a6", "name": "spirited-regal-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43822, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:30.782193+00:00", "ended_at": "2026-08-27T02:26:35.178856+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "13b65fa5-b8a3-4746-b85b-e4f762632974", "name": "silent-wry-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37042, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 339, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:18.360471+00:00", "ended_at": "2026-08-27T02:26:24.757842+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c05ecf64-628f-441d-af7a-6186ea40af74", "name": "dappled-mighty-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38050, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:16.856881+00:00", "ended_at": "2026-08-27T02:26:21.408898+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4483e013-3f1c-4e7b-b6f9-7463570e3302", "name": "vivid-nimble-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57518, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 362, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:26:11.652480+00:00", "ended_at": "2026-08-27T02:26:14.854042+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2454e3e6-a985-491b-b00b-61d7fff10775", "name": "polar-wry-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41024, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:57.857786+00:00", "ended_at": "2026-08-27T02:26:01.289372+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1463ad5f-a77c-42a6-864c-1fdf75e8b832", "name": "hushed-coastal-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 369, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:53.408391+00:00", "ended_at": "2026-08-27T02:25:56.308507+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2e6c0147-bb49-42de-b0c5-077422f1b90a", "name": "glassy-steady-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41956, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:42.435331+00:00", "ended_at": "2026-08-27T02:25:45.587250+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b7f72ec9-b9c1-41a4-8332-75c26fed4862", "name": "gallant-graceful-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41878, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 345, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:30.809047+00:00", "ended_at": "2026-08-27T02:25:34.197614+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6376bf85-a667-40b7-942e-780ce97d9bb8", "name": "wiry-nameless-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47268, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 404, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:30.076396+00:00", "ended_at": "2026-08-27T02:25:36.239934+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0eb29a51-86eb-46b8-937f-b5286d789f8b", "name": "mellow-forlorn-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35630, "username": "manoj", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:26.083523+00:00", "ended_at": "2026-08-27T02:25:34.587051+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "71aae125-97a1-443b-8699-0ea503639375", "name": "barren-leafy-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35728, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 385, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:24.363047+00:00", "ended_at": "2026-08-27T02:25:27.470938+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4b85b0c-eac4-4dac-af52-e463944ef8e6", "name": "courtly-granite-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60954, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:18.764696+00:00", "ended_at": "2026-08-27T02:25:27.430389+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4b65e0e4-19b0-48f6-8f38-c613bad55ec7", "name": "burly-austere-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55958, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:25:02.137641+00:00", "ended_at": "2026-08-27T02:25:05.114983+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "205c690f-2ab3-45cb-9c2a-d66df1292e42", "name": "burly-nimble-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55914, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 337, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:52.803865+00:00", "ended_at": "2026-08-27T02:24:58.271710+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8f39066d-5a5b-4b9a-a737-0e8bbffdc827", "name": "silent-distant-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34898, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:51.578615+00:00", "ended_at": "2026-08-27T02:24:55.238110+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "43f92442-b6d4-4683-ad6b-354ec8e6feb1", "name": "amiable-lonesome-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39484, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:46.364641+00:00", "ended_at": "2026-08-27T02:24:52.376769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "36573d87-b530-48ad-bd06-8ada8eccdd8b", "name": "inland-upland-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39412, "username": "clawdbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:41.200897+00:00", "ended_at": "2026-08-27T02:24:49.293621+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "fe023504-c729-4739-afeb-d53654bfffcf", "name": "ashen-snowy-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56230, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 367, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:32.448599+00:00", "ended_at": "2026-08-27T02:24:37.907398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4d4b49e4-0704-44e0-8a56-79812bfaa858", "name": "lawful-blazing-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49494, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:24.222525+00:00", "ended_at": "2026-08-27T02:24:29.510218+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e3f46fa-2186-4729-b5da-046efbd12f0b", "name": "brave-lively-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49396, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:20.622529+00:00", "ended_at": "2026-08-27T02:24:23.639126+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b665516-5510-49d7-924d-6b0fc51d9a19", "name": "painted-serene-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33640, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:12.536606+00:00", "ended_at": "2026-08-27T02:24:19.974913+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "bbfb45e5-1981-4a34-80ab-474bc3436298", "name": "watchful-honest-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 57042, "username": "chenyu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 562, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:24:11.138293+00:00", "ended_at": "2026-08-27T02:24:12.590042+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "66efd834-eff5-48b7-bd13-58246ac86a00", "name": "thawing-oaken-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43008, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:24:06.642540+00:00", "ended_at": "2026-08-27T02:24:11.928033+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1caa84e0-c9dc-4fd8-a62a-b4a0b24ad459", "name": "orderly-hazy-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57328, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:53.287870+00:00", "ended_at": "2026-08-27T02:23:56.263968+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "00b94fd6-079b-4154-9d0f-c72d4e0929ed", "name": "velvet-rustic-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46684, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 495, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:48.673819+00:00", "ended_at": "2026-08-27T02:23:54.135691+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11c8ca05-3d98-4af1-a03f-17b80a8fc5d9", "name": "cunning-inland-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57262, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 418, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:48.395462+00:00", "ended_at": "2026-08-27T02:23:54.275652+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "700f6f0b-5647-45cd-a602-96d96c10002f", "name": "gnarled-glacial-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59366, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 306, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:46.378941+00:00", "ended_at": "2026-08-27T02:23:53.967237+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "581dc3e2-26c7-4365-845b-39eef2b85439", "name": "keen-diligent-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59272, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:38.727378+00:00", "ended_at": "2026-08-27T02:23:45.236963+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "33a4d3e0-635d-4f92-9592-b858e7036bd4", "name": "fickle-tender-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38308, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:24.367602+00:00", "ended_at": "2026-08-27T02:23:30.125329+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "de2ed1d4-6aee-4a69-9420-d606a634d618", "name": "airy-vigilant-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38204, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 342, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:17.157199+00:00", "ended_at": "2026-08-27T02:23:19.833071+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0723a641-7c7d-4b51-9087-ebcd2daf77f5", "name": "forlorn-salty-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35172, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:10.370079+00:00", "ended_at": "2026-08-27T02:23:16.008747+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95f8ad1b-e266-4d62-a114-d1cb9782b141", "name": "bronzed-valiant-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53418, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:05.466206+00:00", "ended_at": "2026-08-27T02:23:14.372837+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "7dcbec57-c01f-4895-82ae-f339bad1ecc5", "name": "graceful-solemn-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46744, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:23:03.827135+00:00", "ended_at": "2026-08-27T02:23:09.978576+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92fe4bff-37d2-4f98-8006-a000ad266fe4", "name": "hollow-crystal-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53500, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:57.000366+00:00", "ended_at": "2026-08-27T02:23:01.823907+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "303a71ba-a522-4af4-a511-033332660b76", "name": "loyal-feathered-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43386, "username": "omm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 409, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:45.965563+00:00", "ended_at": "2026-08-27T02:22:55.050048+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "3fc65892-290c-49cc-8a7a-cb4cfc76c1fc", "name": "blazing-prickly-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56520, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:35.838430+00:00", "ended_at": "2026-08-27T02:22:40.460773+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9400ba3d-4e2b-4a9b-818d-3721db43b1c4", "name": "russet-languid-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56450, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:25.568319+00:00", "ended_at": "2026-08-27T02:22:29.958463+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed98a13b-a4ca-48fe-bcd5-a9b21ccb908b", "name": "snowy-upland-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42568, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:21.470282+00:00", "ended_at": "2026-08-27T02:22:25.720003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "84eae8ff-545e-425f-a5bd-973f632e649a", "name": "faded-supple-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36684, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 361, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:15.116285+00:00", "ended_at": "2026-08-27T02:22:19.400189+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "59f7ed79-7fe7-4f23-9147-c19272d6629d", "name": "silent-honest-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55936, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:22:02.461565+00:00", "ended_at": "2026-08-27T02:22:08.428997+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3544b180-42c0-49b8-9954-b4434151a259", "name": "hazy-meadow-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55848, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:56.763363+00:00", "ended_at": "2026-08-27T02:22:02.364599+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "406224d4-c89d-454d-91b7-780201999550", "name": "foggy-hollow-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55086, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 383, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:51.043657+00:00", "ended_at": "2026-08-27T02:21:54.523250+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b1420c50-22f7-4549-99cd-735437ede2a5", "name": "tranquil-pristine-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54584, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:46.297405+00:00", "ended_at": "2026-08-27T02:21:51.165905+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "854199a3-038d-4330-9641-8598bfa43310", "name": "fierce-earnest-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44426, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:40.680027+00:00", "ended_at": "2026-08-27T02:21:50.552472+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "e4a50ca0-1eb9-4987-b4d3-b80baa763006", "name": "mighty-gleaming-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46466, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:24.752426+00:00", "ended_at": "2026-08-27T02:21:30.032845+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2976fcbb-8272-4ff5-9570-61a2b98afac0", "name": "thawing-opal-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44350, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:22.777765+00:00", "ended_at": "2026-08-27T02:21:26.019722+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "af0fc781-4a32-4748-906e-a907d9047226", "name": "buoyant-forlorn-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46418, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 357, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:18.909089+00:00", "ended_at": "2026-08-27T02:21:22.582699+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5ce290f-8905-49cf-a7e3-6018bcd7c6af", "name": "lunar-gloomy-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50502, "username": "a", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 336, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:16.951367+00:00", "ended_at": "2026-08-27T02:21:22.292151+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "337d4c9e-4e1a-4be1-a20b-31ab9a12f675", "name": "electric-opal-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40830, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 420, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:14.704632+00:00", "ended_at": "2026-08-27T02:21:22.944137+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "af4b1d26-dac1-4194-a53d-b983cceff10d", "name": "solar-nimble-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53080, "username": "admin123", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 361, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:08.600436+00:00", "ended_at": "2026-08-27T02:21:12.984023+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "73a6bf57-5048-4846-8631-46e4f5766254", "name": "sterling-peaty-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40782, "username": "test1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 394, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:21:06.552458+00:00", "ended_at": "2026-08-27T02:21:13.820391+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "07c9429e-461f-49da-9dfd-973475509346", "name": "brisk-downy-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41440, "username": "monitor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 405, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:57.323114+00:00", "ended_at": "2026-08-27T02:21:03.486770+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "10042d62-abe8-4b59-8dfc-60b474509ea1", "name": "mindful-sleepy-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 46760, "username": "yousef", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 513, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:20:56.350939+00:00", "ended_at": "2026-08-27T02:20:57.008370+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "32e2af25-417c-43ed-a0ca-c64914e0eb4f", "name": "sullen-fickle-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41366, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 401, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:36.991283+00:00", "ended_at": "2026-08-27T02:20:42.564329+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "87764374-a004-400e-8abf-a34761973cbf", "name": "proud-stormy-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55024, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:32.919759+00:00", "ended_at": "2026-08-27T02:20:42.299427+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "54fb428a-ea39-4b0f-a406-e8d48763c53e", "name": "mossy-pleasant-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40494, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:32.150656+00:00", "ended_at": "2026-08-27T02:20:36.118873+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1a6837c9-3f91-4513-94ad-bf51313ee44a", "name": "lucid-quartz-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49502, "username": "marcu1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:26.818761+00:00", "ended_at": "2026-08-27T02:20:36.351483+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4ed73b12-37fd-49bb-a5f4-eb8aa5e55494", "name": "rapid-freckled-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49388, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:10.223391+00:00", "ended_at": "2026-08-27T02:20:16.012013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2286d37c-794f-4faa-bdbe-79f7e8cff612", "name": "watchful-leafy-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41204, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 423, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:09.520258+00:00", "ended_at": "2026-08-27T02:20:17.778330+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d625fe1e-a680-457b-9723-40a430b02488", "name": "primal-gloomy-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60902, "username": "kipt", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:20:02.717117+00:00", "ended_at": "2026-08-27T02:20:10.174185+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "d47f0ff4-b86a-45eb-9c0f-67b7c9d15f2d", "name": "ivory-autumn-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35086, "username": "opc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 562, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:57.478479+00:00", "ended_at": "2026-08-27T02:20:04.882713+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "073589d9-ab39-43c9-918e-e1e42f05ebd2", "name": "stoic-gentle-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35014, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:50.103547+00:00", "ended_at": "2026-08-27T02:19:55.130601+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "e06be6c0-c8b1-439c-8958-8252251f174b", "name": "jagged-snowy-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41138, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 412, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:46.290956+00:00", "ended_at": "2026-08-27T02:19:49.981664+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "589a392f-534d-4504-b099-f3a2b06b15e1", "name": "autumn-diligent-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57510, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:40.428570+00:00", "ended_at": "2026-08-27T02:19:48.721557+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "bfa083cb-378c-4f75-a505-7cb29f37fd62", "name": "wry-lunar-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40306, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 388, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:33.884508+00:00", "ended_at": "2026-08-27T02:19:42.266883+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "5ca69d5f-a33f-4bcb-b1b7-10ec4a268247", "name": "bitter-dusty-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42348, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 389, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:10.957047+00:00", "ended_at": "2026-08-27T02:19:14.848550+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "786afc4b-aef7-47c4-84c9-22c22e2f1e7f", "name": "emerald-fleeting-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34732, "username": "bernard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:06.942619+00:00", "ended_at": "2026-08-27T02:19:13.260847+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "0debef9d-ba60-4e93-99be-e8e0b9863be0", "name": "brazen-salty-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42282, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:19:05.952839+00:00", "ended_at": "2026-08-27T02:19:11.899254+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "08493f28-e1bb-4bf5-b34d-fe483ccd7723", "name": "marbled-burly-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34656, "username": "hu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:58.470837+00:00", "ended_at": "2026-08-27T02:19:06.886667+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "df2d8977-c5d5-47df-bb3c-0366bd79b30a", "name": "plucky-creaky-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 39918, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:52.923503+00:00", "ended_at": "2026-08-27T02:18:58.634613+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a314fc2-3b98-41ad-91ca-de0dd02cbf3c", "name": "gleaming-golden-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45650, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:36.145557+00:00", "ended_at": "2026-08-27T02:18:41.350867+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d55bb88-ee9e-44c2-ac5a-f37f1e519f35", "name": "wooded-gnarled-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:33.952551+00:00", "ended_at": "2026-08-27T02:18:37.721086+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd93d3dd-cc71-4111-9d7c-bf884705c5eb", "name": "coastal-cosmic-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54800, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:28.149452+00:00", "ended_at": "2026-08-27T02:18:32.359460+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "799bd7b6-37ce-4aa9-b7db-8dce49ae203e", "name": "quartz-quaint-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60610, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:25.339674+00:00", "ended_at": "2026-08-27T02:18:31.802233+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "48dba4f0-db47-4c8c-857e-2aa949892319", "name": "candid-knotted-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57014, "username": "admins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:13.110148+00:00", "ended_at": "2026-08-27T02:18:20.633343+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d67081d3-6b1f-4afc-af14-6b9c62bfd8ef", "name": "meadow-wistful-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53624, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 359, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:09.923329+00:00", "ended_at": "2026-08-27T02:18:16.730008+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2be720e1-0f24-4a0e-aafe-39756211c41d", "name": "blunt-sullen-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53682, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:18:06.858585+00:00", "ended_at": "2026-08-27T02:18:10.051177+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "febf170a-71a5-46ae-a4fc-407474613dd3", "name": "gleaming-kindly-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53706, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 406, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:57.124350+00:00", "ended_at": "2026-08-27T02:18:01.222908+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d96a20de-1b23-4046-9901-e0c6141ea4ed", "name": "gleaming-canny-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60360, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:53.483167+00:00", "ended_at": "2026-08-27T02:18:00.531468+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "fd1fad0e-ac7d-4705-94f3-8a996713cdb7", "name": "nameless-lonesome-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53638, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:49.401334+00:00", "ended_at": "2026-08-27T02:17:53.793639+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb077dd9-d37c-4314-ba6d-ceb3d85437a3", "name": "gritty-bold-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 59286, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:17:40.565599+00:00", "ended_at": "2026-08-27T02:17:41.267934+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e6d9832c-c02e-4530-8693-c9e660e7a099", "name": "smooth-wistful-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47626, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 344, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:29.804703+00:00", "ended_at": "2026-08-27T02:17:33.012067+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a40aab48-2e0d-4faf-b25f-9ab8234f2eab", "name": "barren-glassy-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54840, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:25.957884+00:00", "ended_at": "2026-08-27T02:17:32.667242+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "b80b7bcb-4f82-4816-8f3f-2dd418c0be3b", "name": "windswept-jagged-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35090, "username": "sol", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:24.636582+00:00", "ended_at": "2026-08-27T02:17:30.961055+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "0038f503-0cbf-4243-a7f9-913a59700a81", "name": "blithe-vivid-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47670, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 383, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:23.817267+00:00", "ended_at": "2026-08-27T02:17:29.552928+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b124ded0-279e-40e6-9dda-c73a03d5aec4", "name": "downy-jagged-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56770, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:11.475810+00:00", "ended_at": "2026-08-27T02:17:21.022246+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "af37deb0-9562-4876-b62d-36b08a92fbb0", "name": "sunlit-idle-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56722, "username": "aaa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 315, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:08.840421+00:00", "ended_at": "2026-08-27T02:17:11.917839+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3b9efcfc-c6e2-402c-bfa2-3d7341e4359f", "name": "somber-emerald-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54740, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:08.617301+00:00", "ended_at": "2026-08-27T02:17:12.916658+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06addb8d-2f0a-44bc-b4ce-c295bfa20e3e", "name": "emerald-cobalt-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56538, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:03.887568+00:00", "ended_at": "2026-08-27T02:17:08.574106+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "8dc7f2e6-0b42-4d02-ad87-c2652d9e8e8b", "name": "calm-glassy-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56436, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 346, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:17:00.642311+00:00", "ended_at": "2026-08-27T02:17:04.378564+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "182e089a-ec32-4184-b220-b41905e53a4f", "name": "keen-austere-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52438, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:40.705451+00:00", "ended_at": "2026-08-27T02:16:44.989955+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "52cddb9e-ae58-4b1e-b082-988095105787", "name": "oaken-quartz-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47258, "username": "arthur", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 543, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:35.157479+00:00", "ended_at": "2026-08-27T02:16:42.629662+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "20cb2231-33b9-423b-99c1-6a45deb25ddf", "name": "dewy-painted-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40886, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:33.459490+00:00", "ended_at": "2026-08-27T02:16:37.548689+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06e72038-8583-4165-bf84-1f276d10651c", "name": "prairie-sincere-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40808, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:31.656799+00:00", "ended_at": "2026-08-27T02:16:35.050478+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0dfeb368-bfc5-445b-b4d5-285339f71f21", "name": "bronzed-thorny-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47176, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 390, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:23.098411+00:00", "ended_at": "2026-08-27T02:16:29.675672+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "1b9da9e0-de11-4f98-ba90-00cca1e7de2b", "name": "muted-electric-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59536, "username": "edge", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:18.860492+00:00", "ended_at": "2026-08-27T02:16:24.319152+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "6f5c93ee-837f-4a8d-9c3f-abbd452fa902", "name": "bold-western-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35514, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:12.314492+00:00", "ended_at": "2026-08-27T02:16:18.175365+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "ab9496c9-7364-486d-a611-4cf8558111be", "name": "crisp-loyal-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59472, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:16:03.286168+00:00", "ended_at": "2026-08-27T02:16:08.606257+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d260349-1ce7-46a4-9c32-24d6d6214952", "name": "gritty-supple-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49394, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:15:54.655136+00:00", "ended_at": "2026-08-27T02:15:58.876299+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03785cee-7e39-43a5-8978-bd2ed82cef5a", "name": "wistful-glacial-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49340, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:15:49.724038+00:00", "ended_at": "2026-08-27T02:15:55.612022+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "72145c52-4ca3-4d72-8f9a-0e94e2543463", "name": "glassy-arctic-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54662, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:15:27.913516+00:00", "ended_at": "2026-08-27T02:15:32.887819+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d281b35a-8f16-44c1-a84c-5f85206608ef", "name": "fabled-blithe-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54586, "username": "fred", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:15:27.708074+00:00", "ended_at": "2026-08-27T02:15:36.347885+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "bd58bd88-212d-4729-a7ef-2faacb26a5a7", "name": "zealous-reedy-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57874, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:15:03.282114+00:00", "ended_at": "2026-08-27T02:15:08.008831+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09975e09-f1b2-409f-9fe3-ef5b6349349e", "name": "windswept-whispering-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41478, "username": "lin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:54.285632+00:00", "ended_at": "2026-08-27T02:14:58.904544+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "10e88262-f678-475d-b191-e401bd6e4a6b", "name": "pristine-forlorn-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41410, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:46.701828+00:00", "ended_at": "2026-08-27T02:14:49.176428+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "604e2a84-c15a-4c14-bab3-569ddfea93e9", "name": "cobalt-clever-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47616, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:41.486487+00:00", "ended_at": "2026-08-27T02:14:43.561062+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e56f4d37-69af-4be5-b583-9e7cd9794e8e", "name": "jaunty-subtle-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47570, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:35.734194+00:00", "ended_at": "2026-08-27T02:14:37.494226+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d3ad58c0-2fe7-4f8b-b064-b25311eacf0b", "name": "rambling-vigilant-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36454, "username": "work", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:31.800527+00:00", "ended_at": "2026-08-27T02:14:35.854201+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4f4ddfec-ee7f-4d0f-b5ad-1fb11b0d0c19", "name": "lofty-golden-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44610, "username": "bitrix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:29.855467+00:00", "ended_at": "2026-08-27T02:14:35.883409+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c7ddeb3d-4381-4567-8c73-475e615993d2", "name": "thorny-tidal-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44532, "username": "mcserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:22.473637+00:00", "ended_at": "2026-08-27T02:14:27.244747+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "d1da1b95-ce2e-4428-83dd-f05cd49f124e", "name": "shaded-subtle-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59980, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:13.357448+00:00", "ended_at": "2026-08-27T02:14:14.626146+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86c023bd-0f08-4440-9bb3-c09cf12ebe28", "name": "idle-plush-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59974, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:14:03.206564+00:00", "ended_at": "2026-08-27T02:14:04.332946+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4febe64b-4ca1-400d-914c-33515125d438", "name": "pewter-pristine-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38834, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:59.371301+00:00", "ended_at": "2026-08-27T02:14:03.887498+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "03a2ebd4-9706-49d8-a13e-8069ad4b98d4", "name": "quartz-marbled-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60626, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:51.099418+00:00", "ended_at": "2026-08-27T02:13:52.600056+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7fc9d9f7-a9a6-4384-b809-58495a82ef94", "name": "lucid-grumpy-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60588, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:38.943366+00:00", "ended_at": "2026-08-27T02:13:40.505221+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e88b164d-eab6-402c-acb4-0608ad11bc3c", "name": "dapper-frank-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56694, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 262, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:31.937401+00:00", "ended_at": "2026-08-27T02:13:32.689847+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f356218c-1dd9-44f4-981d-80ee376d3ee0", "name": "orderly-sunlit-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56642, "username": "odoo14", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:29.539341+00:00", "ended_at": "2026-08-27T02:13:33.671271+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "798f2c50-ed4c-43fa-bbba-e3b2d74290d2", "name": "rambling-jovial-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54326, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:21.367851+00:00", "ended_at": "2026-08-27T02:13:22.132123+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8948be90-85cc-4e02-a454-f0787f681110", "name": "gallant-eager-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44182, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 370, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:09.318102+00:00", "ended_at": "2026-08-27T02:13:09.539393+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8488be46-b225-4141-b4a0-6bd73e789603", "name": "nimble-velvet-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44078, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:13:00.023319+00:00", "ended_at": "2026-08-27T02:13:00.106193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "82d0b1fb-5c5e-41c2-9968-dada9c7e7006", "name": "rapid-crisp-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43744, "username": "centreon", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:12:55.104167+00:00", "ended_at": "2026-08-27T02:12:58.448727+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "e3cf0ae5-0c89-49a0-b34f-06eec6bd8b8b", "name": "frosty-airy-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44598, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:36.914519+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 5, "transcript_bytes": 276 }, { "id": "3c536c4d-e9d4-4fbb-a337-a5a1cf42b7f8", "name": "subtle-pewter-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33012, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:36.402183+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 14, "transcript_bytes": 1656 }, { "id": "8248d9a3-4a86-4428-9449-40329d153b45", "name": "plush-gilded-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37574, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:35.455163+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 8, "transcript_bytes": 611 }, { "id": "d8848149-ac88-4c61-9c6e-f88a7f937886", "name": "pristine-cosmic-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44672, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:34.016899+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 4, "transcript_bytes": 240 }, { "id": "47f482c0-ec75-40ef-bb97-13898f1de555", "name": "ivory-dewy-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58488, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:33.878207+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 10, "transcript_bytes": 783 }, { "id": "e958ff60-62c0-400b-8e69-2f0ed0474f12", "name": "dapper-daring-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37520, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:33.584516+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 9, "transcript_bytes": 664 }, { "id": "78affd21-cd38-4f24-9617-27a46ecd3cd1", "name": "serene-courtly-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43722, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:32.942752+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 12, "transcript_bytes": 848 }, { "id": "0879d5e5-c11f-4acf-8b79-fb1e60c049ae", "name": "flinty-sunlit-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58418, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:32.347187+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 11, "transcript_bytes": 820 }, { "id": "b2d69ca8-d5fe-4b44-99e7-27525ee5e0ca", "name": "flinty-leafy-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56042, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:31.859007+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 2, "transcript_bytes": 147 }, { "id": "9cd39c0f-bbbd-497c-8940-43d926899029", "name": "wiry-indigo-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53446, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:12:30.837558+00:00", "ended_at": "2026-08-27T02:12:39.210456+00:00", "ended_reason": "honeypot reconnected", "commands": 5, "transcript_bytes": 378 }, { "id": "eeb0a382-f411-490d-829f-1a9cb14279b0", "name": "umber-kindly-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33070, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:12:29.732687+00:00", "ended_at": "2026-08-27T02:12:35.043930+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9693e5b-4fea-4dc2-a151-70d0c56fcc97", "name": "hushed-jolly-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42122, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:12:12.934107+00:00", "ended_at": "2026-08-27T02:12:17.000524+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1710aa4c-28c1-4a8d-a5f2-6aaed9dd820f", "name": "amber-airy-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53956, "username": "mc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:55.244267+00:00", "ended_at": "2026-08-27T02:12:03.843005+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "682af7d8-4036-4134-9447-7f7011698804", "name": "lively-ashen-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42088, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:55.102447+00:00", "ended_at": "2026-08-27T02:12:00.111722+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37dd0f25-49d2-4e5e-8183-aa6dd91681a5", "name": "marbled-mighty-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53888, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:35.902468+00:00", "ended_at": "2026-08-27T02:11:40.867072+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "61c28e07-a2f2-4afe-ae28-87961a4d3325", "name": "frugal-fleeting-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36034, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:22.112133+00:00", "ended_at": "2026-08-27T02:11:25.614362+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "25174dba-064a-4806-aae1-e48164d98701", "name": "mellow-granite-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52876, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:14.165628+00:00", "ended_at": "2026-08-27T02:11:15.370766+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d3c3677a-c653-4175-bcd1-3b05cf53961d", "name": "drifting-golden-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52788, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:04.479331+00:00", "ended_at": "2026-08-27T02:11:05.976523+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ec55565d-38c3-4db7-9536-e5279c5a61d2", "name": "supple-orderly-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54446, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:11:00.796449+00:00", "ended_at": "2026-08-27T02:11:01.950019+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "420d535e-4aec-44d5-b5ca-69b4befccac3", "name": "fearless-candid-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54400, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:56.367963+00:00", "ended_at": "2026-08-27T02:10:57.831478+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d7f49df-8889-4bf4-933c-82d43a081816", "name": "quaint-gentle-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43974, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:49.050121+00:00", "ended_at": "2026-08-27T02:10:50.919308+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07815d92-fdc4-4d1b-8254-d26958f0bcfa", "name": "granite-mellow-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47022, "username": "osmc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:47.338841+00:00", "ended_at": "2026-08-27T02:10:51.600661+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "21f86bce-9280-40cd-a259-6f458dd00c03", "name": "leafy-scarlet-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46958, "username": "csgo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:40.414403+00:00", "ended_at": "2026-08-27T02:10:45.967333+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f1babaf3-93c6-4be8-aac3-96b6fd5e3976", "name": "stoic-supple-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50428, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:30.851009+00:00", "ended_at": "2026-08-27T02:10:32.971804+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b24e5881-ed01-4ecb-b428-51407945607f", "name": "dusty-misty-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51372, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:23.005360+00:00", "ended_at": "2026-08-27T02:10:24.285779+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f75f928-9025-4375-a7e9-786509056c64", "name": "subtle-sullen-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51254, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:21.590967+00:00", "ended_at": "2026-08-27T02:10:27.006433+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "d59fdad7-b2a4-43f0-afb8-d09dc3fe9232", "name": "frugal-rambling-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44460, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:10:08.973436+00:00", "ended_at": "2026-08-27T02:10:10.329447+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ab6d2059-8c9a-4e03-b365-75238c7161e6", "name": "lunar-patient-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44354, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:56.272576+00:00", "ended_at": "2026-08-27T02:09:57.537066+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a2ee7283-3f6c-4b46-978d-ea20ddafc79e", "name": "early-ginger-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35360, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:48.284298+00:00", "ended_at": "2026-08-27T02:09:48.955773+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8394135e-0514-4f40-bea5-d57596e5b8f7", "name": "marine-quaint-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58790, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:43.116066+00:00", "ended_at": "2026-08-27T02:09:43.963671+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c43181ab-463f-436d-a377-ba33375fd279", "name": "spirited-grassy-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58708, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:39.582053+00:00", "ended_at": "2026-08-27T02:09:42.873353+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1665 }, { "id": "bad1214e-b58f-44c6-9deb-441a45d8d508", "name": "dapper-tender-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57392, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:25.322306+00:00", "ended_at": "2026-08-27T02:09:25.441268+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa1c8efe-28e7-4344-8523-46dd2c089a78", "name": "misty-cheerful-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57328, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:19.027732+00:00", "ended_at": "2026-08-27T02:09:19.113876+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1809cd37-813c-4a42-b8d2-97ea5723a3a8", "name": "cheerful-quartz-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52538, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 344, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:09:14.723829+00:00", "ended_at": "2026-08-27T02:09:14.882053+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "375e6a0a-1be4-4b56-b9f3-e932cf85eb08", "name": "fearless-supple-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51612, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:54.080013+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 12, "transcript_bytes": 848 }, { "id": "36f88ed3-0506-4a5e-baa9-93c6fe5d71fb", "name": "dapper-vernal-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40926, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:52.520945+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 8, "transcript_bytes": 611 }, { "id": "dadc4c1e-fc71-4a1c-9a5c-53c96a0c4534", "name": "rustic-noble-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47118, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:52.374533+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 5, "transcript_bytes": 276 }, { "id": "617faa3c-934c-4b8e-8741-df189c426bd0", "name": "fearless-tangled-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40878, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:52.308671+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 9, "transcript_bytes": 664 }, { "id": "9a82a5a6-07a4-49a5-ac26-45f96089e4a8", "name": "restless-eager-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51656, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:52.205095+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 10, "transcript_bytes": 782 }, { "id": "d0a7ba48-310a-437d-866f-e7043e743789", "name": "stoic-feathered-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41100, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:51.871190+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 12, "transcript_bytes": 848 }, { "id": "b2d3dcec-2fdb-4355-a321-c5f956c9a146", "name": "humble-prairie-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40790, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:51.215158+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 5, "transcript_bytes": 378 }, { "id": "cad20b67-bd25-4e51-9f13-00f019701177", "name": "murky-jaunty-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44320, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:50.872099+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 2, "transcript_bytes": 147 }, { "id": "b1a14766-d072-4fdc-a11e-af0abdfbd8c5", "name": "gleaming-dapper-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47158, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-27T02:08:50.757106+00:00", "ended_at": "2026-08-27T02:09:00.608017+00:00", "ended_reason": "honeypot reconnected", "commands": 3, "transcript_bytes": 220 }, { "id": "33b8c278-df66-4fad-a608-cae1a56c9c50", "name": "muted-kindly-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43630, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:40.637302+00:00", "ended_at": "2026-08-27T02:08:45.704524+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4f59cc70-e120-4547-be12-10506810ced6", "name": "nameless-restless-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43656, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:40.392338+00:00", "ended_at": "2026-08-27T02:08:45.845270+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3af6fe6-6af6-46f5-a0dc-8bccf9220e61", "name": "upland-obsidian-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45742, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:33.308612+00:00", "ended_at": "2026-08-27T02:08:40.386013+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ac783e88-843c-41c1-aa08-14eccdb0923a", "name": "jagged-regal-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45802, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:28.731522+00:00", "ended_at": "2026-08-27T02:08:32.829956+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "703a339b-fbd1-4612-9c32-aa057b8cabe9", "name": "fearless-kindly-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41074, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:20.496314+00:00", "ended_at": "2026-08-27T02:08:23.865057+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "24496c65-d9c7-483d-978d-028f2e7a0ff1", "name": "vivid-lawful-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44630, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:18.683540+00:00", "ended_at": "2026-08-27T02:08:23.080698+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "788f715c-e0f8-4ead-a737-d4f816b5986f", "name": "diligent-buoyant-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44578, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:09.771494+00:00", "ended_at": "2026-08-27T02:08:14.978031+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed65f33d-62b8-4a0f-87a6-234a8d5a53ad", "name": "honest-bashful-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36672, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:08:00.200139+00:00", "ended_at": "2026-08-27T02:08:03.134165+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "97567f62-c7d9-45cd-bc9f-549a60556cc5", "name": "fickle-brazen-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58606, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:54.671846+00:00", "ended_at": "2026-08-27T02:08:01.763365+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "66d5a86a-77e2-4957-8302-68876bbe7dc3", "name": "lucid-dappled-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37616, "username": "factorio", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 354, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:54.644331+00:00", "ended_at": "2026-08-27T02:08:00.231821+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "d3a4d40a-e5c0-4106-bafe-829c062ba3b0", "name": "gleaming-orderly-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36634, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:53.379160+00:00", "ended_at": "2026-08-27T02:07:56.567611+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "19156d51-f5e7-41b4-a2d2-bc739e72e2a0", "name": "subtle-honest-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37502, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:41.975012+00:00", "ended_at": "2026-08-27T02:07:47.283165+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7d6add3-58e3-4bfd-97bc-d061d07e9be8", "name": "gilded-shaded-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48732, "username": "bot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:38.075473+00:00", "ended_at": "2026-08-27T02:07:46.292776+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "0ba5ce5e-40fc-4bae-9f74-d3fbc6ebd0e1", "name": "stoic-pleasant-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 48682, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:24.950551+00:00", "ended_at": "2026-08-27T02:07:30.815341+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "32fb29f5-da5e-4091-a94b-1af689991d7d", "name": "gritty-meadow-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33768, "username": "dani", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:20.123673+00:00", "ended_at": "2026-08-27T02:07:28.221750+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "d0fed7b6-fccf-4823-86bb-904ddf8da366", "name": "lucid-merry-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40588, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:18.261632+00:00", "ended_at": "2026-08-27T02:07:22.067798+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f52ef518-8208-430c-8017-809fa6d8a8d3", "name": "wooded-tender-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43950, "username": "esroot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:04.484078+00:00", "ended_at": "2026-08-27T02:07:10.486844+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "aaa63a3c-45dc-4f2e-9627-a391bc24b719", "name": "drifting-shaded-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33698, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:07:03.784262+00:00", "ended_at": "2026-08-27T02:07:07.624002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a1382911-5a92-4a64-92c3-58a6b8411465", "name": "dappled-airy-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51320, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:59.208051+00:00", "ended_at": "2026-08-27T02:07:03.774014+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "66d13196-378b-4d86-96a9-6c0d1965b611", "name": "feathered-cunning-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43898, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:56.224022+00:00", "ended_at": "2026-08-27T02:07:02.820052+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "4afef829-2b68-4dc3-bdec-b31e8edf5992", "name": "grassy-clever-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37556, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:44.037273+00:00", "ended_at": "2026-08-27T02:06:47.512065+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "39de8817-1e64-42ae-865d-eae1a2e5b09e", "name": "reedy-amber-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46532, "username": "Caps", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 504, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:40.234057+00:00", "ended_at": "2026-08-27T02:06:49.941990+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "edc56a6d-e928-4b9a-880f-f976719fa0e4", "name": "dutiful-nimble-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46592, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:33.040081+00:00", "ended_at": "2026-08-27T02:06:35.882374+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5a87a7b-c84e-463a-a2d3-92e8a21505bb", "name": "indigo-peaty-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49162, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:19.041503+00:00", "ended_at": "2026-08-27T02:06:23.346544+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "017c8818-722e-4aa5-ab5e-0df182515342", "name": "eager-calm-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54318, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:18.153402+00:00", "ended_at": "2026-08-27T02:06:24.241878+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2b11cf79-634d-4a72-874d-443e40d46074", "name": "sandy-frugal-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 55304, "username": "toby", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:06:10.980914+00:00", "ended_at": "2026-08-27T02:06:12.218336+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "561ebc52-a9a8-43fd-b154-95111c674fbe", "name": "alpine-northern-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33100, "username": "gabriel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 324, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:06:09.057474+00:00", "ended_at": "2026-08-27T02:06:17.934616+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "4673a1fc-3159-48c3-be7b-da1a3d7f1363", "name": "spirited-flinty-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33014, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:53.400540+00:00", "ended_at": "2026-08-27T02:05:56.991292+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0fdcefd-ac51-444e-ae12-c65e6cba73fa", "name": "scarlet-lunar-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34022, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 374, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:50.545540+00:00", "ended_at": "2026-08-27T02:05:54.016403+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a579cd3a-8c86-4a85-a2fc-86dcf3ef7ebf", "name": "coastal-honest-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60812, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 273, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:44.696586+00:00", "ended_at": "2026-08-27T02:05:53.651100+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0a809f58-76e7-43b8-b237-90d77692a718", "name": "dewy-seaward-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60840, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:42.767176+00:00", "ended_at": "2026-08-27T02:05:47.261729+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da5e8957-e096-4798-84e4-693dc13e7b12", "name": "indigo-bashful-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34786, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:33.251461+00:00", "ended_at": "2026-08-27T02:05:40.138831+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "017964d3-fb54-4eca-bb64-25ca261ec98a", "name": "muted-jolly-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47506, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:25.378170+00:00", "ended_at": "2026-08-27T02:05:28.416771+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce13f9a3-7eae-4ef7-8765-117da1497666", "name": "keen-plush-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34642, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:15.441252+00:00", "ended_at": "2026-08-27T02:05:18.825165+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b32f38a9-d00f-4171-91b4-402248037267", "name": "sullen-crystal-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58160, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:14.217780+00:00", "ended_at": "2026-08-27T02:05:19.433299+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "32f0f634-01a7-40c0-8a27-fe8f7eaf1941", "name": "rustic-tidal-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59694, "username": "main", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:08.012851+00:00", "ended_at": "2026-08-27T02:05:14.134774+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "cf595a15-00bb-436e-aaa4-53236e7effcb", "name": "autumn-kindly-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59708, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 404, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:05:03.283705+00:00", "ended_at": "2026-08-27T02:05:06.560275+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba1cc3b0-44e8-43cb-96df-062d99a9377a", "name": "tidal-tangled-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52190, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:53.302413+00:00", "ended_at": "2026-08-27T02:05:02.878147+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "f6643ef6-9d0a-4205-9593-043ad3dce771", "name": "frosty-restless-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35164, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:42.827108+00:00", "ended_at": "2026-08-27T02:04:47.641000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2827f413-1f59-47ca-8929-4b71c7940d2d", "name": "lanky-blazing-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42804, "username": "coder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:26.762178+00:00", "ended_at": "2026-08-27T02:04:35.342864+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6d2c32ca-28f4-479b-917e-d124ebe22a5b", "name": "sleepy-misty-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57964, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:26.511141+00:00", "ended_at": "2026-08-27T02:04:29.730936+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4c417fc8-768e-40ac-a4c5-9764dd9ae82c", "name": "upland-jovial-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57880, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:26.308576+00:00", "ended_at": "2026-08-27T02:04:32.275395+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6e58ca76-4347-49b3-8151-87f08588d70c", "name": "feathered-coral-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47926, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:09.908742+00:00", "ended_at": "2026-08-27T02:04:15.159190+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1317dee8-835f-4eba-89dc-4b9c911b3c36", "name": "early-hushed-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50270, "username": "usuario", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 306, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:09.431080+00:00", "ended_at": "2026-08-27T02:04:17.829414+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "bf085a9f-dd76-44c2-8d04-a2ac7dcf3668", "name": "calm-gnarled-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47864, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:04:05.778218+00:00", "ended_at": "2026-08-27T02:04:08.730918+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "239806a6-9c70-4712-b3d4-8a85ab130d2a", "name": "hazy-buoyant-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55976, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:57.895210+00:00", "ended_at": "2026-08-27T02:04:04.187591+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e02bf71a-e056-441e-ae0f-a29b89a0486e", "name": "civil-stoic-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38704, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:44.744146+00:00", "ended_at": "2026-08-27T02:03:47.583174+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "826cfb96-524c-41e6-b136-2abaf21591fa", "name": "windswept-brazen-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38632, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:43.996332+00:00", "ended_at": "2026-08-27T02:03:48.554366+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03628bf6-932f-4222-bb01-ed0e1c143466", "name": "ruddy-steady-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54522, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:32.646448+00:00", "ended_at": "2026-08-27T02:03:37.807021+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "57779227-83e8-43a5-81d7-75cd3369efbb", "name": "glacial-hearty-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 46424, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 560, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:03:29.032587+00:00", "ended_at": "2026-08-27T02:03:30.102092+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "577c413e-8643-4c34-b84b-a5db5ced0cfb", "name": "windswept-airy-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55194, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 502, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:26.929644+00:00", "ended_at": "2026-08-27T02:03:32.666628+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "7027ebb4-629d-4df6-92cc-ed3cbfd870a6", "name": "oaken-sandy-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55324, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:23.416948+00:00", "ended_at": "2026-08-27T02:03:26.979401+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "22d9e57b-e313-48be-a96a-d65fb2aa7ce8", "name": "blazing-serene-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36740, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 426, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:19.808937+00:00", "ended_at": "2026-08-27T02:03:26.408687+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9b368562-e581-47ce-9fba-e413186a7aab", "name": "umber-idle-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51538, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:03:03.986608+00:00", "ended_at": "2026-08-27T02:03:07.313654+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d12dd943-fd82-4131-9018-4795518e6814", "name": "russet-slender-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37008, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 378, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:55.011440+00:00", "ended_at": "2026-08-27T02:03:03.623610+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ae40f1af-afa2-4761-a05c-6f4df47c6ccc", "name": "murky-early-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51476, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:47.222622+00:00", "ended_at": "2026-08-27T02:02:50.534493+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95127a14-d71d-4468-a420-dc67c8f32494", "name": "shaded-prickly-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40142, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 412, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:35.554531+00:00", "ended_at": "2026-08-27T02:02:39.505533+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d5e28d21-87ff-4bdd-b2b7-25c5308f2a35", "name": "forlorn-subtle-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40066, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:27.299160+00:00", "ended_at": "2026-08-27T02:02:31.160331+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d74ef26-8032-4026-b1ca-572a308eac02", "name": "smoky-dappled-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43484, "username": "demo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 383, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:22.077659+00:00", "ended_at": "2026-08-27T02:02:29.816439+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "eb221dc8-e16b-4e08-89c2-15d4aba82e71", "name": "sandy-feral-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50464, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:19.806495+00:00", "ended_at": "2026-08-27T02:02:22.875789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ca04aa8-b02b-4a6a-8551-b8bdaf9d0b45", "name": "graceful-wooded-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43540, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:14.487020+00:00", "ended_at": "2026-08-27T02:02:18.624489+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70fa7c40-232f-4a67-977d-761708ea316f", "name": "languid-lively-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37230, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:06.009532+00:00", "ended_at": "2026-08-27T02:02:11.953350+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "c7dd6097-c472-4a7c-89a7-8c29013952b3", "name": "obsidian-blazing-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 40532, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:02:05.964834+00:00", "ended_at": "2026-08-27T02:02:12.343561+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "739c72fe-797f-45b9-80d8-6afd1b33575f", "name": "seaward-opal-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52684, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:50.009658+00:00", "ended_at": "2026-08-27T02:01:54.263627+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "91206f86-2748-47bd-8563-2c0d85390662", "name": "ginger-sincere-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33428, "username": "odoo16", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:35.445838+00:00", "ended_at": "2026-08-27T02:01:41.957787+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ce71354a-7431-42c6-9631-683542823b03", "name": "rugged-smooth-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:34.898262+00:00", "ended_at": "2026-08-27T02:01:40.415465+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4a1e4a1-5f85-4274-82f4-073ab2841ed5", "name": "upland-bronzed-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:29.719715+00:00", "ended_at": "2026-08-27T02:01:33.715186+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c8b4e973-a343-47b4-8ab7-0698f1f0ea4e", "name": "arctic-marbled-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47508, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:12.894389+00:00", "ended_at": "2026-08-27T02:01:21.027884+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7750ba28-2a15-40c1-910b-06617f818d2f", "name": "sincere-wistful-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47570, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:10.788159+00:00", "ended_at": "2026-08-27T02:01:13.473698+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "489b542b-ff5e-46f0-a924-70f11eccb116", "name": "painted-flinty-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34998, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:04.964460+00:00", "ended_at": "2026-08-27T02:01:11.738156+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f8d2609c-f065-4eb0-a96f-656656165955", "name": "weathered-mighty-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50878, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:01:02.538446+00:00", "ended_at": "2026-08-27T02:01:08.038488+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fe366799-d73f-419c-a197-eeb675f90419", "name": "sullen-eager-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:40.819730+00:00", "ended_at": "2026-08-27T02:00:44.612913+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86b9f2ba-4002-4f79-b871-453649dc4078", "name": "fabled-twilight-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34684, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:33.047393+00:00", "ended_at": "2026-08-27T02:00:38.459952+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0185c8d3-eb7b-4524-9f5d-422ea37375a9", "name": "patient-hardy-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34632, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 370, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:31.234770+00:00", "ended_at": "2026-08-27T02:00:36.594076+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e4d9a36-7e21-4759-885a-bfc6f65a6a2f", "name": "hazy-fickle-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45802, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 422, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:17.663032+00:00", "ended_at": "2026-08-27T02:00:22.254264+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c91960f-9386-47a0-ac2e-315e750291ea", "name": "coral-salty-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 59792, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 543, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:00:16.565060+00:00", "ended_at": "2026-08-27T02:00:17.631058+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "041f15be-9a43-46b9-894f-9a362e227b03", "name": "mellow-meadow-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46036, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 398, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:14.765309+00:00", "ended_at": "2026-08-27T02:00:24.242995+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "836adeee-7f91-4320-9e38-add7412ba438", "name": "granite-reedy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37316, "username": "hamed", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 422, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:14.689366+00:00", "ended_at": "2026-08-27T02:00:23.958827+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "775de47d-5336-4330-93ee-7977bdb5daf1", "name": "icy-plucky-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46114, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T02:00:10.074841+00:00", "ended_at": "2026-08-27T02:00:16.946484+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "683eba4b-5d14-49ed-99a4-0b28bff42b94", "name": "northern-reedy-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 34286, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 339, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:58.195354+00:00", "ended_at": "2026-08-27T02:00:06.590722+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7574e25d-272e-4a43-b127-071c40e66c40", "name": "kindly-whispering-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37244, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:55.777966+00:00", "ended_at": "2026-08-27T02:00:01.832915+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f68f468b-68cf-4a1d-b1e8-beede480d5e5", "name": "zealous-clever-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56828, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:54.236791+00:00", "ended_at": "2026-08-27T02:00:01.940490+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "fee25386-0b9f-4f94-adae-084bfbe8ec69", "name": "weathered-plucky-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 56716, "username": "ranga", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:49.893715+00:00", "ended_at": "2026-08-27T01:59:56.597170+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "c071b4d3-1c95-40d9-a897-264ff7447d03", "name": "buoyant-western-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36914, "username": "dspace", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:37.016427+00:00", "ended_at": "2026-08-27T01:59:45.195174+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "59dd970f-65e0-4a95-9a81-d9ec3db260b0", "name": "smoky-orderly-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51054, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:24.564558+00:00", "ended_at": "2026-08-27T01:59:31.435061+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "f612ec27-0e1b-4920-a520-ebde92b7bb1c", "name": "jagged-fickle-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38778, "username": "labuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:22.910499+00:00", "ended_at": "2026-08-27T01:59:28.991501+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "f41d070f-1bcd-445a-8085-307013855384", "name": "oaken-orderly-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38744, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:03.883946+00:00", "ended_at": "2026-08-27T01:59:07.524611+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e22991a-e4d1-4444-b7dd-8e1b42113824", "name": "foggy-honest-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 59720, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 403, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:00.729413+00:00", "ended_at": "2026-08-27T01:59:05.798952+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d2dbad1-ec43-43ad-b08e-0983dc41c9c0", "name": "marbled-snowy-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 32922, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:59:00.437115+00:00", "ended_at": "2026-08-27T01:59:08.609508+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1669 }, { "id": "d79fd5a6-e9b1-410a-8a1a-045912ed8b86", "name": "icy-balmy-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57924, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:46.822418+00:00", "ended_at": "2026-08-27T01:58:52.911842+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9e1d2c48-a58b-4a06-9fb2-f32caac8f48c", "name": "velvet-mighty-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 32864, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:45.613080+00:00", "ended_at": "2026-08-27T01:58:49.689685+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ddf22fb3-8f7c-4bdd-b1ab-0eddd1ead206", "name": "shifting-pewter-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44240, "username": "test2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:45.135577+00:00", "ended_at": "2026-08-27T01:58:52.476964+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "9e3b52ea-c66c-43bb-9c5a-2bf4e76bc93c", "name": "rustic-shifting-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44176, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:39.581861+00:00", "ended_at": "2026-08-27T01:58:48.432352+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "1e1441c8-3640-4b38-b98c-ea7b6482ae81", "name": "silent-eager-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43020, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 344, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:33.937175+00:00", "ended_at": "2026-08-27T01:58:42.160117+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7cb5fe0d-f983-43a1-8d4a-f65c1f26d965", "name": "prickly-somber-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46670, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 363, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:14.784710+00:00", "ended_at": "2026-08-27T01:58:20.615723+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3fc49423-a97d-4fe3-8c4d-1d0143cf8476", "name": "cobalt-curious-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46654, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 361, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:09.100602+00:00", "ended_at": "2026-08-27T01:58:14.368083+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "628ca7d4-f6de-4181-af81-59cee531170f", "name": "murky-jovial-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41156, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:58:01.281080+00:00", "ended_at": "2026-08-27T01:58:07.242001+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "62961374-1468-400c-96f6-1af6c3436d75", "name": "earnest-noble-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 37968, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:57.251730+00:00", "ended_at": "2026-08-27T01:58:05.990627+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "ce4f96cd-13de-4627-9ff1-fa8929ec2105", "name": "coral-thawing-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38058, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:56.722405+00:00", "ended_at": "2026-08-27T01:58:00.680468+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3265e830-fd46-45ab-98bf-82776c85edd5", "name": "lofty-sleepy-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54580, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:47.283532+00:00", "ended_at": "2026-08-27T01:57:52.523477+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2fad9b74-cccd-4082-ab05-efd93534e59c", "name": "airy-cheerful-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54634, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 409, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:44.444782+00:00", "ended_at": "2026-08-27T01:57:53.578422+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "934e052d-4922-411b-82a7-e11876c39f53", "name": "nautical-electric-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60348, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:28.609705+00:00", "ended_at": "2026-08-27T01:57:32.385254+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "504109e7-9e24-4cef-9567-44f7fb0bbe75", "name": "seaward-early-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 60292, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:23.976855+00:00", "ended_at": "2026-08-27T01:57:27.233148+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e6fbd895-e8fd-42d2-a1d7-4bbf17e39e49", "name": "vaulted-curious-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46556, "username": "onkar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:19.379516+00:00", "ended_at": "2026-08-27T01:57:26.444803+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "afeeac3c-a60d-4bef-9234-421cd5494019", "name": "tangled-cunning-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46518, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:57:08.447577+00:00", "ended_at": "2026-08-27T01:57:13.139094+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f84b496-5c89-47c9-b585-87bbb34b6e9b", "name": "rugged-idle-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 42640, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:57:01.767425+00:00", "ended_at": "2026-08-27T01:57:02.861508+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "0bc6a51b-6ea9-4ab0-90fd-6c64057b46ed", "name": "hollow-fierce-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 53146, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:52.755969+00:00", "ended_at": "2026-08-27T01:56:56.706193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6574e0ea-8f8b-4828-aebc-fdfe6ab7d0a9", "name": "jagged-rambling-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43764, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:51.726757+00:00", "ended_at": "2026-08-27T01:56:58.586053+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "d670bcbf-90d5-4fbb-8d81-57ecd4d6fe77", "name": "meadow-hidden-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49912, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 389, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:50.174386+00:00", "ended_at": "2026-08-27T01:56:57.764363+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "35cbb8b6-0c8f-4370-9305-3529bc2cb4a5", "name": "deft-rugged-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 43704, "username": "packer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:45.951109+00:00", "ended_at": "2026-08-27T01:56:51.910230+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "56cfaf7d-915c-4df2-b0d4-394ed5601021", "name": "plucky-fearless-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 49864, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:30.813417+00:00", "ended_at": "2026-08-27T01:56:35.374470+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5e4c55c0-1a0f-4360-9a7a-23adccc93ce2", "name": "lawful-glassy-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47132, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:20.100606+00:00", "ended_at": "2026-08-27T01:56:24.371855+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd1e41cd-b774-42fb-a766-6d10982a7878", "name": "sunlit-pristine-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52612, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:17.126799+00:00", "ended_at": "2026-08-27T01:56:22.960491+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "33f14580-a444-4a1c-a9eb-fff15cbdf9c0", "name": "pewter-polar-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 52530, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:07.925056+00:00", "ended_at": "2026-08-27T01:56:12.238525+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2db4f496-0551-4ac8-a07c-f2bea6d6ac3e", "name": "merry-lawful-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51602, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:04.899381+00:00", "ended_at": "2026-08-27T01:56:13.389134+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "e2d1b6c6-d516-4660-8f50-c2e17bbe921a", "name": "amber-wry-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 51542, "username": "rock", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:56:00.188193+00:00", "ended_at": "2026-08-27T01:56:08.377052+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3155e34c-dcc6-4365-9702-2e1816bad2dc", "name": "cheerful-opal-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 44398, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:55:59.550641+00:00", "ended_at": "2026-08-27T01:56:02.358900+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4258c09-5862-432b-bb04-795857e9491a", "name": "arctic-airy-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 46460, "username": "kelly", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:55:51.684963+00:00", "ended_at": "2026-08-27T01:56:01.583693+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "2c243e9d-47bc-4dd2-8889-72fb6ecc2b04", "name": "curious-vernal-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57318, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:55:36.074611+00:00", "ended_at": "2026-08-27T01:55:39.823611+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7b70bb8-980c-421f-bd87-6018323de185", "name": "windswept-inland-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57258, "username": "vpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:55:34.157084+00:00", "ended_at": "2026-08-27T01:55:39.353808+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "54c12cae-eabf-4333-aeea-ed574492475c", "name": "weathered-sunlit-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50492, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 465, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:55:19.294950+00:00", "ended_at": "2026-08-27T01:55:22.556210+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f9c56a3-fb37-4fd9-bb82-29ccde63ca81", "name": "honest-bashful-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 50444, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:55:05.200121+00:00", "ended_at": "2026-08-27T01:55:10.400003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69c3c0c7-9992-47fe-bc33-bf0c6de221dc", "name": "emerald-sullen-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58248, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 374, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:51.713888+00:00", "ended_at": "2026-08-27T01:54:56.500761+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "18e3bc8e-41f2-4c21-98d2-fcea1ff70e2f", "name": "fringed-mindful-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35142, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 504, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:45.119758+00:00", "ended_at": "2026-08-27T01:54:51.093198+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6ef28b1c-680b-459f-b487-17e29fb91cab", "name": "primal-wiry-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 35080, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:33.557071+00:00", "ended_at": "2026-08-27T01:54:38.184355+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "55527ea5-40d2-4cc1-899b-4495bcd3597d", "name": "dapper-lively-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38556, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:26.960698+00:00", "ended_at": "2026-08-27T01:54:28.892268+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a645503a-1060-4c5c-8d73-1ee79d3057ec", "name": "clever-fearless-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 38470, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 501, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:20.813906+00:00", "ended_at": "2026-08-27T01:54:22.067333+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "57c22fa9-13dd-4b21-be1c-3c5cc593bb68", "name": "chilly-sandy-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 54448, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 597, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:15.645053+00:00", "ended_at": "2026-08-27T01:54:16.890112+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b80fa1e-27cd-4ff2-a53e-7b5811eab874", "name": "genial-obsidian-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47054, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 894, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:12.666689+00:00", "ended_at": "2026-08-27T01:54:18.917533+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "476f4ccb-8943-4257-b126-04e7dfe9a01e", "name": "coral-autumn-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47118, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 743, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:12.466362+00:00", "ended_at": "2026-08-27T01:54:18.327870+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "356a6a67-8c68-4bfa-b5fa-41461eb0b655", "name": "gleaming-gloomy-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 42822, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1142, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:02.108771+00:00", "ended_at": "2026-08-27T01:54:03.429509+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3bcd7571-61e9-4374-a351-478b63b31998", "name": "placid-canny-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45218, "username": "teste", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1390, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:54:00.461319+00:00", "ended_at": "2026-08-27T01:54:06.798156+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "c2e72c45-346a-4967-8eb9-bce2ae647eb4", "name": "subtle-shaded-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 45314, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1054, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:57.369761+00:00", "ended_at": "2026-08-27T01:53:59.410491+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6ca990be-7d7e-4807-92bf-ea8d1e1d4225", "name": "noble-feral-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 41354, "username": "wso2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:52.453185+00:00", "ended_at": "2026-08-27T01:54:01.209474+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3df4f059-c34b-4115-a3aa-bcd9be781bf6", "name": "prairie-icy-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 34544, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 558, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:53:49.922814+00:00", "ended_at": "2026-08-27T01:53:51.302086+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "b67d5c11-c52b-4481-b0fd-76037ac617a6", "name": "silent-blithe-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 58022, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1409, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:40.997371+00:00", "ended_at": "2026-08-27T01:53:51.713678+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "4c0f53bb-4134-4460-8abe-00a74c9ae902", "name": "tawny-grumpy-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 57974, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1929, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:36.353862+00:00", "ended_at": "2026-08-27T01:53:49.445529+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "a0b5da72-5b94-45ec-a902-0dbf972842dc", "name": "salty-rustic-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 47836, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1633, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:25.943195+00:00", "ended_at": "2026-08-27T01:53:37.506689+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "db95dbab-8dd3-4555-b286-3d05ec5d5651", "name": "marine-pleasant-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36122, "username": "christianna", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1895, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:20.024291+00:00", "ended_at": "2026-08-27T01:53:33.565392+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "8966c4b0-7525-4b60-8bb4-1ed7bfd27cc7", "name": "lonesome-thawing-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 36074, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 2018, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:11.403142+00:00", "ended_at": "2026-08-27T01:53:26.372294+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a7fea3f9-ef47-4af0-95c2-d8949b81ce66", "name": "gloomy-blithe-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 33836, "username": "uploader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 2072, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:05.984308+00:00", "ended_at": "2026-08-27T01:53:20.982000+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "cc4d1fdb-55f3-45dc-9a61-6b169720d687", "name": "shifting-curious-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.217", "src_port": 55928, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 2361, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-27T01:53:00.068929+00:00", "ended_at": "2026-08-27T01:53:17.302168+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1665 }, { "id": "196f1d27-2c48-4975-ba0b-ddd181b0dab5", "name": "icy-grumpy-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 32900, "username": "oracle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:50:32.380524+00:00", "ended_at": "2026-08-27T01:50:33.575565+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "9229aa80-23b4-4320-acbf-4916bcd0e6ad", "name": "sooty-golden-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 54798, "username": "wjx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:47:29.547521+00:00", "ended_at": "2026-08-27T01:47:30.894678+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "5d170d24-50a3-41f2-b2a6-f2ed8dd45d3d", "name": "tidal-pleasant-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 36436, "username": "testserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:44:30.225882+00:00", "ended_at": "2026-08-27T01:44:31.735209+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2265 }, { "id": "688b3edf-2678-4644-a938-c3e7d46e0c0e", "name": "plush-ashen-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 48012, "username": "wushi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:41:45.157077+00:00", "ended_at": "2026-08-27T01:41:46.363063+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "cf6775e3-99df-4276-b034-0548a506f67d", "name": "meadow-umber-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 41666, "username": "VPN", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 518, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:38:59.630835+00:00", "ended_at": "2026-08-27T01:39:00.963779+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "33dfaf6c-a578-4c80-8a86-82e9aa4f5c40", "name": "marbled-somber-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 39998, "username": "alma", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:35:49.956104+00:00", "ended_at": "2026-08-27T01:35:51.548596+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "0532f9d0-de19-4259-ac4e-e3bb61f94e62", "name": "blazing-curious-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49768, "username": "vpsuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:32:33.115570+00:00", "ended_at": "2026-08-27T01:32:34.542697+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "dbe62335-4e5e-4818-ab78-456f858b9be9", "name": "breezy-forlorn-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 33206, "username": "igor", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 543, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:29:16.307101+00:00", "ended_at": "2026-08-27T01:29:17.362010+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "66d7fd29-009f-483e-9c71-fd43eb389e87", "name": "fierce-glacial-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 33574, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:23:09.177870+00:00", "ended_at": "2026-08-27T01:23:10.500250+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bfcb867e-cf3f-4e83-b971-4cb292be2b4a", "name": "grassy-snowy-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 36980, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 520, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:19:50.901302+00:00", "ended_at": "2026-08-27T01:19:52.508860+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "baf9edd4-8eab-45b6-99e9-d2bceea49c71", "name": "regal-ivory-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 36252, "username": "client", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 514, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:17:07.613064+00:00", "ended_at": "2026-08-27T01:17:08.769650+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "3e870c39-c9a8-4024-99f4-6357f24d91dc", "name": "thrifty-solemn-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 53860, "username": "edwin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 513, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:14:00.724812+00:00", "ended_at": "2026-08-27T01:14:02.097768+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "7927f727-777d-425d-a918-c42e95a40e8c", "name": "dusty-honest-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 51866, "username": "docker", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:10:45.323484+00:00", "ended_at": "2026-08-27T01:10:46.841590+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "575f8bc6-f8c8-4f63-925f-1e744944f020", "name": "slender-dewy-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 33074, "username": "ashish", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:07:49.458024+00:00", "ended_at": "2026-08-27T01:07:50.570753+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2237 }, { "id": "633faf4c-a0a3-4be5-b02f-5141979685ad", "name": "dapper-nimble-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 56552, "username": "root2", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:04:49.081590+00:00", "ended_at": "2026-08-27T01:04:50.555496+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2270 }, { "id": "53ff8ccc-cf47-4170-a33c-af3e7ec1aa6f", "name": "upland-hushed-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 52344, "username": "es", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:01:44.923784+00:00", "ended_at": "2026-08-27T01:01:46.412093+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "8bb1840d-1c97-4d2c-b932-11905850fd71", "name": "windswept-civil-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 43432, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 555, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:58:29.699246+00:00", "ended_at": "2026-08-27T00:58:31.016165+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "9c9204b5-b416-4d6d-b3d1-eccace0e90c5", "name": "boreal-serene-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 45992, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:55:24.223136+00:00", "ended_at": "2026-08-27T00:55:25.280584+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "9dc4ef9c-3031-4587-b567-997bc168067c", "name": "gleaming-austere-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 42424, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:52:18.999740+00:00", "ended_at": "2026-08-27T00:52:20.000176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2170 }, { "id": "cc4229b0-76f4-4588-b70a-92eee7a51923", "name": "sincere-verdant-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 39982, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:49:16.596636+00:00", "ended_at": "2026-08-27T00:49:17.603128+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2169 }, { "id": "9f734da3-9d18-470b-8ac2-f370ec450cbf", "name": "cobalt-smooth-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "179.102.26.14", "src_port": 3832, "username": "core", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 420, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:47:10.978402+00:00", "ended_at": "2026-08-27T00:47:11.698129+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2042 }, { "id": "a2b864d8-6190-407a-b621-bf22434555cd", "name": "nameless-seaward-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 57348, "username": "gitea", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:46:10.720378+00:00", "ended_at": "2026-08-27T00:46:12.209171+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2163 }, { "id": "2ef49375-1827-4419-971a-07984cb2a427", "name": "quartz-crimson-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 57234, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 535, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:42:56.877146+00:00", "ended_at": "2026-08-27T00:42:57.957604+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "1f78f223-366e-4f69-9e15-b5e4f42eaef1", "name": "cobalt-hazy-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 44492, "username": "sora", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:39:54.403067+00:00", "ended_at": "2026-08-27T00:39:55.526725+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2126 }, { "id": "c9ef5156-8586-4eae-9c3d-5a91117b00e8", "name": "forlorn-quiet-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "97.74.87.152", "src_port": 33282, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 742, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:38:36.484406+00:00", "ended_at": "2026-08-27T00:38:37.325893+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "96e7c7e4-2a04-4fbf-a76e-0be66d30de68", "name": "restless-tidal-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 60220, "username": "michal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:36:44.572496+00:00", "ended_at": "2026-08-27T00:36:46.059069+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2127 }, { "id": "1d3ba961-9947-47ed-8fd6-6400b59e5ee3", "name": "solar-rapid-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 56892, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:33:42.846708+00:00", "ended_at": "2026-08-27T00:33:44.173413+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2161 }, { "id": "b6208ed3-6316-446d-9834-3837e3d83399", "name": "nautical-graceful-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 58962, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:30:43.803559+00:00", "ended_at": "2026-08-27T00:30:45.265857+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "522f4b42-b84d-4bf6-91b3-d747fd167d87", "name": "rapid-candid-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 46664, "username": "mailuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:27:42.331054+00:00", "ended_at": "2026-08-27T00:27:43.807106+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2078 }, { "id": "c4fa3bbc-ecba-4a1f-b0ad-4b87b4fe1fae", "name": "prairie-ivory-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49256, "username": "ssl", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:24:30.857302+00:00", "ended_at": "2026-08-27T00:24:32.153617+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2072 }, { "id": "5edb1ccb-d4dc-4fe7-b301-528eb53018b3", "name": "frank-dappled-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 50422, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 581, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:21:10.422459+00:00", "ended_at": "2026-08-27T00:21:11.831471+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "d07cf30b-8560-4b85-bbb5-af953dfb9455", "name": "early-deft-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 50678, "username": "ftp_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:17:53.831192+00:00", "ended_at": "2026-08-27T00:17:54.534356+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2057 }, { "id": "d8569d23-7d3d-4484-a143-bef4fc61640a", "name": "jaunty-northern-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 34414, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:14:46.269218+00:00", "ended_at": "2026-08-27T00:14:47.160675+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "48a02821-9c28-49b2-a275-dbf93718a57c", "name": "northern-diligent-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 57256, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:54:02.157985+00:00", "ended_at": "2026-08-26T22:54:03.018766+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "edd0c314-fcb9-447c-b79a-3656dc46905b", "name": "fabled-murky-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 57498, "username": "admin123", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:51:58.922845+00:00", "ended_at": "2026-08-26T22:52:00.471746+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "f9e62d41-1d36-4fdd-af5c-5dddd67fcffc", "name": "coastal-frosty-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 47664, "username": "mahendra", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:50:04.919657+00:00", "ended_at": "2026-08-26T22:50:07.051229+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "22fe2092-f0d9-4d16-894b-ecbb034222d0", "name": "velvet-burly-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 59282, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:48:14.443094+00:00", "ended_at": "2026-08-26T22:48:15.808304+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "414307d0-dd10-440b-9f46-4fa975f862e3", "name": "orderly-thawing-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 47676, "username": "test_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:46:19.827969+00:00", "ended_at": "2026-08-26T22:46:20.812519+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2270 }, { "id": "d52ebf8a-fda9-4565-9359-5d037052d946", "name": "mindful-pewter-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 60222, "username": "rolando", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:44:24.890570+00:00", "ended_at": "2026-08-26T22:44:26.728059+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "0570332a-1fd4-4a47-ada3-ec6409b397ff", "name": "cunning-graceful-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 46574, "username": "chenl", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:42:33.369511+00:00", "ended_at": "2026-08-26T22:42:35.381203+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "4e719400-061f-4e49-adcd-cf9a46eb27dc", "name": "candid-diligent-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 41206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:40:30.789721+00:00", "ended_at": "2026-08-26T22:40:31.645165+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8e0602a6-803d-4475-a86b-78953a99927b", "name": "dusky-breezy-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49254, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:38:28.814053+00:00", "ended_at": "2026-08-26T22:38:29.858603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "234121c6-c9e6-48f3-b120-fc8473397bec", "name": "prairie-thawing-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 50274, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:36:31.926723+00:00", "ended_at": "2026-08-26T22:36:33.135610+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8821cc7f-cb2b-4c0b-8112-dc93ca0c24ad", "name": "blithe-honest-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49446, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:34:33.498009+00:00", "ended_at": "2026-08-26T22:34:34.540507+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "8889b794-3420-499b-ba77-e0fca6219a78", "name": "bitter-vernal-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 51584, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:32:36.517304+00:00", "ended_at": "2026-08-26T22:32:37.388096+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "712ad059-f7ef-4421-9f20-094279b3228f", "name": "fringed-snowy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 44534, "username": "mcserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 67, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:30:30.060127+00:00", "ended_at": "2026-08-26T22:30:32.225340+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "f13ddc6a-8276-4281-b3e3-e91d11f18595", "name": "fringed-canny-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 48524, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:28:36.867877+00:00", "ended_at": "2026-08-26T22:28:38.389448+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "7aa65e49-1024-4c9f-97af-154317883f7e", "name": "sooty-pewter-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49162, "username": "minecraft", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:26:36.605992+00:00", "ended_at": "2026-08-26T22:26:38.807153+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "3bdfa553-0792-4bb2-8f21-8f3acd304c18", "name": "grumpy-jolly-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 51582, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 69, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:24:40.906880+00:00", "ended_at": "2026-08-26T22:24:43.107634+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "40fa65fd-fcab-4975-9d61-7c84f4d67b80", "name": "diligent-burly-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 52690, "username": "yx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:22:35.264741+00:00", "ended_at": "2026-08-26T22:22:36.950695+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "a72392cf-d7c3-496c-aa59-bdc47134a553", "name": "prairie-lunar-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 44288, "username": "maman", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:20:28.578573+00:00", "ended_at": "2026-08-26T22:20:30.099169+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "c8627d04-62b1-494d-82ff-b6cc011a3e3a", "name": "lawful-woven-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 54148, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:18:25.699676+00:00", "ended_at": "2026-08-26T22:18:27.811255+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8e9aaf29-e88c-4627-8177-0a58996b1ba1", "name": "blunt-upland-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 60036, "username": "temp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:16:34.039368+00:00", "ended_at": "2026-08-26T22:16:35.749635+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "7c80ea31-a5d7-47d8-9d64-fa955b5c95c6", "name": "glassy-steady-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 34022, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:14:40.341165+00:00", "ended_at": "2026-08-26T22:14:41.446011+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "90c527d1-48c6-4a7e-b55d-45fe617f00d2", "name": "twilight-salty-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 52062, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:12:36.684422+00:00", "ended_at": "2026-08-26T22:12:38.672663+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "bb42f020-30f3-48f4-ba69-533aac8acef4", "name": "dapper-frosty-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 37444, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:10:41.273002+00:00", "ended_at": "2026-08-26T22:10:42.385536+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6d235e27-e165-46dc-8ac2-95f6bf835fed", "name": "sterling-craggy-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 37062, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:08:43.418751+00:00", "ended_at": "2026-08-26T22:08:44.723626+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "3b24c531-37d5-4a03-b704-e7a0bc25d543", "name": "loyal-hidden-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 56834, "username": "incoming", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:06:41.442149+00:00", "ended_at": "2026-08-26T22:06:42.304238+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "c57d2cd2-02dc-4248-becb-7de5688deb67", "name": "slender-sleepy-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55168, "username": "scott", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:04:41.876826+00:00", "ended_at": "2026-08-26T22:04:43.752675+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "9e0ea237-f358-4f21-9d07-7015e4e5e4d6", "name": "gallant-icy-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 45762, "username": "n8n", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:02:44.947266+00:00", "ended_at": "2026-08-26T22:02:46.144310+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "5c3a7c5e-09ab-45fb-96f1-72a11c840af0", "name": "lively-diligent-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 50540, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:00:42.826853+00:00", "ended_at": "2026-08-26T22:00:44.379794+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "497be21b-7be1-47e8-bbc7-464eedc2053d", "name": "gnarled-upland-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 38984, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:58:49.387001+00:00", "ended_at": "2026-08-26T21:58:50.374846+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "11aa2cbd-fe21-46e3-b0d6-344145a643ec", "name": "marine-tranquil-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55188, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:56:44.073129+00:00", "ended_at": "2026-08-26T21:56:45.527588+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "910bee72-8600-4d52-af3a-d73a00585467", "name": "coral-lively-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 40922, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:54:51.098099+00:00", "ended_at": "2026-08-26T21:54:51.967026+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "dc56c274-7f9e-42de-a185-441ab6ed2f79", "name": "wiry-merry-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 43208, "username": "it", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 73, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:52:53.047241+00:00", "ended_at": "2026-08-26T21:52:54.392693+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2220 }, { "id": "e0a23090-474a-4bcc-b4e2-c83a6a258114", "name": "dewy-faded-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 45852, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:50:48.908832+00:00", "ended_at": "2026-08-26T21:50:50.825332+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "89f01967-b6fd-431c-99de-62e5d676979e", "name": "jaunty-ancient-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 59308, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:48:55.007378+00:00", "ended_at": "2026-08-26T21:48:56.445720+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2196 }, { "id": "19a88dac-d478-40f2-a4ab-5ecb2d32a4d4", "name": "bold-nameless-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 56664, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 71, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:46:42.168677+00:00", "ended_at": "2026-08-26T21:46:44.366812+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "d372a842-883e-4aee-b7bf-c487f63997e5", "name": "plush-amiable-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 46896, "username": "behnam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 67, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:44:49.415915+00:00", "ended_at": "2026-08-26T21:44:50.314075+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2174 }, { "id": "4cd4cfa2-a3e0-4e5d-96a9-2f2538ed1b79", "name": "placid-emerald-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 39934, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:42:51.688062+00:00", "ended_at": "2026-08-26T21:42:53.178355+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2216 }, { "id": "f94fc549-d7ec-40c8-a223-8b20c6e0ed4f", "name": "lawful-merry-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 44310, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:40:48.158444+00:00", "ended_at": "2026-08-26T21:40:49.292764+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2203 }, { "id": "7db919dd-d72b-4961-897a-fa558ce6d909", "name": "courtly-dewy-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 57444, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:38:55.902990+00:00", "ended_at": "2026-08-26T21:38:57.202707+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "bb45dbdb-4045-4094-9ed3-6209e9e31690", "name": "glacial-vernal-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "41.111.227.10", "src_port": 51206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:37:13.185250+00:00", "ended_at": "2026-08-26T21:37:13.851923+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "0f22c5aa-bc0d-4de4-92dc-df46039b662f", "name": "painted-wiry-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 47040, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:35:05.727119+00:00", "ended_at": "2026-08-26T21:35:07.870729+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "b32ef2f4-0de6-4bda-9d42-191ca760d171", "name": "pleasant-verdant-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 41664, "username": "andrei", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:33:00.409369+00:00", "ended_at": "2026-08-26T21:33:02.191440+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2113 }, { "id": "5e466ecf-96c8-48a2-81bb-9aa6878ab1fe", "name": "forlorn-airy-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:31:03.393133+00:00", "ended_at": "2026-08-26T21:31:05.334337+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "8d3d7962-2361-41fb-b214-58651d26d07b", "name": "pewter-gallant-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55372, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:29:02.848236+00:00", "ended_at": "2026-08-26T21:29:04.782689+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "0fe4342f-6f8f-4c46-8bd5-98bbe654a4f2", "name": "freckled-hushed-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 58222, "username": "lenovo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:26:59.444044+00:00", "ended_at": "2026-08-26T21:27:01.598404+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2086 }, { "id": "1fec95c7-044b-4fc2-be60-59b63ff187be", "name": "vernal-peaty-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 35232, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:25:07.667501+00:00", "ended_at": "2026-08-26T21:25:09.073224+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "dbe14320-b328-4906-b218-12cf23fd2830", "name": "sunlit-clever-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55536, "username": "dbadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 66, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:23:14.941747+00:00", "ended_at": "2026-08-26T21:23:15.883585+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2065 }, { "id": "3d52c553-63f2-4812-bec4-2a59e48b7714", "name": "leafy-boreal-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 45218, "username": "tim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:21:11.571637+00:00", "ended_at": "2026-08-26T21:21:12.115800+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2048 }, { "id": "8a39205c-22a2-4fa3-b48f-0ba1dd2bbacc", "name": "golden-eager-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 40070, "username": "don", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 73, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:19:13.356498+00:00", "ended_at": "2026-08-26T21:19:13.890166+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2045 }, { "id": "73362dea-c90c-4f58-a277-db9665c8c86d", "name": "cobalt-tidal-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.51.208.158", "src_port": 33235, "username": "mars", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:35:02.320364+00:00", "ended_at": "2026-08-26T18:35:02.981268+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "e5bbe61c-4330-4c76-b8b7-169e1a52688c", "name": "wistful-solemn-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 58454, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:28:31.967852+00:00", "ended_at": "2026-08-26T18:28:33.184528+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "489fe293-0c72-4ce4-ad63-285e100aebb5", "name": "primal-indigo-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 52828, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:25:33.989776+00:00", "ended_at": "2026-08-26T18:25:35.452780+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0c527c33-e864-4482-b126-9d9487034a67", "name": "wandering-whispering-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 52410, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:22:37.007494+00:00", "ended_at": "2026-08-26T18:22:38.014476+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2265 }, { "id": "01030d1d-e31f-407f-81e3-04200798ba22", "name": "daring-humble-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 56538, "username": "frontend", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:19:41.005370+00:00", "ended_at": "2026-08-26T18:19:42.106771+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "33d09e0a-72d7-4661-aaad-ca12bd5e1b36", "name": "gnarled-slender-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 55992, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 536, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:16:36.587288+00:00", "ended_at": "2026-08-26T18:16:38.154660+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2c017946-ac04-4700-8400-03e439d05a6d", "name": "bold-humble-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 50998, "username": "support", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:13:39.636117+00:00", "ended_at": "2026-08-26T18:13:40.822236+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2292 }, { "id": "be48beab-5d11-4398-b754-4d558975a7c3", "name": "placid-northern-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 37064, "username": "ian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:10:31.207276+00:00", "ended_at": "2026-08-26T18:10:32.850047+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "88e82370-d6e4-49df-9fe7-07c4ee56db9c", "name": "lively-painted-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 33744, "username": "andy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:07:35.477191+00:00", "ended_at": "2026-08-26T18:07:36.937886+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "015510ba-cea4-469c-9467-beeb6085312d", "name": "mellow-cheerful-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 47128, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 542, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:04:40.564645+00:00", "ended_at": "2026-08-26T18:04:41.652112+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "67859af0-a50c-42d2-acee-a97ec9efad1f", "name": "bronzed-glassy-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 34416, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:01:46.915015+00:00", "ended_at": "2026-08-26T18:01:48.495916+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6f5791c3-fba9-4d8c-93d1-ac54ecc14cfc", "name": "bashful-civil-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 39658, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:58:46.871208+00:00", "ended_at": "2026-08-26T17:58:47.874485+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "42c8c558-be26-41de-bb4f-a2857d57b4d0", "name": "somber-frugal-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 45384, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:55:47.776042+00:00", "ended_at": "2026-08-26T17:55:48.730455+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6e386465-3bb6-4d0e-94d3-53afdbec0a0f", "name": "bashful-coastal-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 33048, "username": "b1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:52:45.810411+00:00", "ended_at": "2026-08-26T17:52:47.218282+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "85e5618c-019d-4ab9-b5ec-763679292810", "name": "brave-mighty-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 51704, "username": "administrator", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:49:45.923841+00:00", "ended_at": "2026-08-26T17:49:47.279948+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2272 }, { "id": "b28b3946-f40a-4a62-aad3-426a0baa5ba0", "name": "ginger-blithe-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 45198, "username": "camera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:46:44.963741+00:00", "ended_at": "2026-08-26T17:46:46.472443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "8362a899-814a-4232-9e21-5f7d15ea2953", "name": "ruddy-ancient-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 58700, "username": "osadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:43:45.444701+00:00", "ended_at": "2026-08-26T17:43:46.470951+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "1c769f06-f9f6-43a3-b9d6-eb995d5ad61e", "name": "shifting-granite-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 36146, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:40:50.947543+00:00", "ended_at": "2026-08-26T17:40:52.293510+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "93ef68b0-34e4-4cb8-9604-d7f2d61343c0", "name": "bitter-amiable-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 59452, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 536, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:37:47.927305+00:00", "ended_at": "2026-08-26T17:37:49.152592+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "79f7ac4d-90e9-48c0-970f-f9867fa65fd3", "name": "western-bronzed-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 35534, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 511, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:34:46.894710+00:00", "ended_at": "2026-08-26T17:34:48.125503+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "c7f4841d-94b6-48a5-a1a5-b3460139507d", "name": "faded-hushed-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 48426, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:31:49.785155+00:00", "ended_at": "2026-08-26T17:31:51.183273+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "ca44722c-8e24-4640-ac8d-99a7a80da1f9", "name": "sincere-weathered-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 59808, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 549, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:28:55.684304+00:00", "ended_at": "2026-08-26T17:28:57.131528+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "04d8d87e-c675-4844-aef2-717c1814d070", "name": "painted-canny-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 35508, "username": "kevin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:25:58.561111+00:00", "ended_at": "2026-08-26T17:26:00.154051+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "4218c19a-437a-497c-96ad-c76533e859b1", "name": "lawful-sturdy-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 45024, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:23:07.545343+00:00", "ended_at": "2026-08-26T17:23:08.968897+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2092c945-ba1d-4b8d-91c9-6ad647fcdf48", "name": "faded-jolly-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 44208, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 539, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:20:13.004124+00:00", "ended_at": "2026-08-26T17:20:14.511849+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "44c50a88-9dbd-49f3-b57a-76d64fdc0a5d", "name": "genial-mighty-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 50650, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:17:22.479193+00:00", "ended_at": "2026-08-26T17:17:23.573581+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "67ee518b-6e71-49b1-afcc-a116e782369c", "name": "brazen-wry-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 37428, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:14:22.643635+00:00", "ended_at": "2026-08-26T17:14:23.689337+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "255d38df-02f0-4cca-898c-7b78b044f7ea", "name": "marine-knotted-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 38998, "username": "asag", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:11:25.039414+00:00", "ended_at": "2026-08-26T17:11:26.414109+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "29b3df17-c552-48fc-bff5-8d8f330f9603", "name": "stoic-creaky-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43112, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:08:26.813864+00:00", "ended_at": "2026-08-26T17:08:28.398127+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "3ca54ba6-e0a4-4626-b417-5f43c9cc5874", "name": "somber-gentle-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 60100, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:05:33.235416+00:00", "ended_at": "2026-08-26T17:05:34.581998+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "9f0bee0b-ab92-4117-82fc-9ef6d2db3505", "name": "murky-blazing-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 39672, "username": "metabase", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:02:42.709476+00:00", "ended_at": "2026-08-26T17:02:44.147919+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "b08d1268-1073-4121-9931-19eb832d67e7", "name": "freckled-thorny-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 33064, "username": "jupyter", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:59:41.891718+00:00", "ended_at": "2026-08-26T16:59:43.572865+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "b64052af-e251-4e94-bc05-5ff4676c7fa5", "name": "dusky-tawny-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 53834, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:56:41.435014+00:00", "ended_at": "2026-08-26T16:56:42.891316+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "24cde9e0-a18e-47da-b329-6317d940d3bf", "name": "stoic-hearty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43112, "username": "jenny1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:53:36.175527+00:00", "ended_at": "2026-08-26T16:53:37.626016+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2220 }, { "id": "815c960d-2ca0-4ed4-8fa8-222a00322bf7", "name": "stoic-sincere-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43722, "username": "store", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:50:37.663189+00:00", "ended_at": "2026-08-26T16:50:39.241651+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "399c04e2-db52-4a37-8947-ae9cba25946a", "name": "weathered-noble-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43468, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 542, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:47:42.889485+00:00", "ended_at": "2026-08-26T16:47:44.105346+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "a658bcf5-063f-4dff-8e9a-afd117f622cb", "name": "sturdy-glacial-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 54946, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 499, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:44:52.681323+00:00", "ended_at": "2026-08-26T16:44:54.097677+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2236 }, { "id": "dc749601-cd80-4f73-991b-77c916554db9", "name": "crystal-sandy-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 56228, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:41:54.034654+00:00", "ended_at": "2026-08-26T16:41:55.391110+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2227 }, { "id": "0cf5ac88-aba7-4987-86b4-c7729d5c142d", "name": "sincere-lively-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 40512, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:39:02.987858+00:00", "ended_at": "2026-08-26T16:39:04.412047+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2214 }, { "id": "dfe32516-dbf5-44c6-aa2a-50a49dc95018", "name": "graceful-smooth-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 35794, "username": "paid", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:36:02.128642+00:00", "ended_at": "2026-08-26T16:36:03.176412+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2148 }, { "id": "b91537f6-9ff1-4eeb-af5b-04d617557b37", "name": "airy-honest-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 40950, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 496, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:33:02.375277+00:00", "ended_at": "2026-08-26T16:33:03.404191+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "75affbd1-c17d-485c-9aea-c1c42dbbde55", "name": "painted-graceful-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 36700, "username": "karen", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:29:58.222822+00:00", "ended_at": "2026-08-26T16:29:59.668350+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2135 }, { "id": "655e187b-1b6c-4f6f-b8d0-b41b99e7244f", "name": "patient-early-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 51188, "username": "wildfly", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:27:02.283756+00:00", "ended_at": "2026-08-26T16:27:03.790352+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2122 }, { "id": "7309f578-a866-4771-bdff-e5bd2781e96b", "name": "blunt-honest-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 37414, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:24:06.570257+00:00", "ended_at": "2026-08-26T16:24:08.047062+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "59f849ca-0769-4f62-ae81-c5fda7b7d22f", "name": "bronzed-tender-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 44514, "username": "radio", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:21:13.077028+00:00", "ended_at": "2026-08-26T16:21:14.094126+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "1fc75d50-bf66-43fc-8c41-28fb77d086c2", "name": "merry-boreal-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 35354, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:20:17.693462+00:00", "ended_at": "2026-08-26T16:20:18.128916+00:00", "ended_reason": "exec complete", "commands": 3, "transcript_bytes": 9819 }, { "id": "c2ad3376-8caf-4624-8dd2-ec45d7cb9756", "name": "coastal-regal-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 60766, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:18:25.226591+00:00", "ended_at": "2026-08-26T16:18:25.362869+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bd8328f6-a8fc-4fe2-bc07-df1da51a5910", "name": "blithe-weathered-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 40810, "username": "controlm", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 499, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:18:18.633554+00:00", "ended_at": "2026-08-26T16:18:20.403154+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2094 }, { "id": "51c78759-f8f4-46c7-bdc1-3820efd2e63e", "name": "hollow-velvet-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 57922, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:16:08.164719+00:00", "ended_at": "2026-08-26T16:16:08.290032+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f57ca815-b782-4e35-be98-071ce4ec1f9d", "name": "somber-mottled-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 59328, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:14:52.536092+00:00", "ended_at": "2026-08-26T16:14:53.834919+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2126 }, { "id": "81e53f55-72a7-4952-b533-a5bc1b172592", "name": "noble-feathered-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 55060, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:14:05.877140+00:00", "ended_at": "2026-08-26T16:14:06.004539+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "db3cec95-98a1-45a5-9705-d78bf1c9a029", "name": "orderly-wooded-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 52204, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:12:15.619195+00:00", "ended_at": "2026-08-26T16:12:15.727005+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bafd474c-e03f-424c-be68-3e985b4e0fd4", "name": "sullen-misty-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 51918, "username": "servidor", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 521, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:11:48.430238+00:00", "ended_at": "2026-08-26T16:11:49.728042+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2062 }, { "id": "49fac436-e767-4d97-adb7-a2aeea6f4635", "name": "lucid-muted-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 49344, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:10:24.631428+00:00", "ended_at": "2026-08-26T16:10:24.758753+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b5467cdb-015c-4b4f-9341-16cdb32175c3", "name": "sleepy-emerald-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 56616, "username": "arthur", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:08:46.379888+00:00", "ended_at": "2026-08-26T16:08:47.311563+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2047 }, { "id": "f6aa313f-8543-44b7-9b12-e68226a604e6", "name": "bashful-foggy-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 46466, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:08:37.455319+00:00", "ended_at": "2026-08-26T16:08:37.560895+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "23a9fb9c-5201-46e8-aab0-6326f09fcf93", "name": "daring-watchful-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 43570, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:06:49.192379+00:00", "ended_at": "2026-08-26T16:06:49.374787+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7ad9ac4b-316b-4ca6-9db6-dcbd2ba0263b", "name": "jagged-barren-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 49888, "username": "reza", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:06:07.069167+00:00", "ended_at": "2026-08-26T16:06:07.761835+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2034 }, { "id": "cc6fdb07-6f82-4d91-a817-aaa6b6bcdcf0", "name": "mottled-marbled-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 40708, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:04:59.966245+00:00", "ended_at": "2026-08-26T16:05:00.104883+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "79c994ff-1043-48de-b877-ad144b653374", "name": "nameless-bashful-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 37870, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:03:06.194213+00:00", "ended_at": "2026-08-26T16:03:06.308859+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "781f0fa7-6ac3-47ca-8792-2ab888a6ad06", "name": "leafy-shifting-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "14.225.173.146", "src_port": 35112, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1424, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:02:51.702893+00:00", "ended_at": "2026-08-26T16:02:52.866853+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "541a13ec-c19a-423a-99f8-cada782cf517", "name": "somber-tranquil-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "182.253.79.195", "src_port": 3862, "username": "lighthouse", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 802, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:01:34.453333+00:00", "ended_at": "2026-08-26T16:01:35.228882+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2048 }, { "id": "0c194abd-47cb-4432-a0bb-e0d11e0d7933", "name": "nautical-barren-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 34992, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T16:01:02.058803+00:00", "ended_at": "2026-08-26T16:01:02.168006+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b495c2af-3aa9-4524-a7b4-8f13b69f7fba", "name": "sleepy-muted-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 60356, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:58:59.869134+00:00", "ended_at": "2026-08-26T15:59:00.129334+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "964c3f65-e47a-406a-b05b-833bc0b5f8cb", "name": "solar-civil-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 57450, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:57:02.123790+00:00", "ended_at": "2026-08-26T15:57:02.285697+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0a01dd42-97fe-4e30-bec5-e2fd17def843", "name": "plucky-icy-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 54566, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:55:08.687869+00:00", "ended_at": "2026-08-26T15:55:08.857686+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cdf86597-2d41-46e4-aa9a-e9a9e24ee7b2", "name": "silent-bitter-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 51666, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:53:21.348194+00:00", "ended_at": "2026-08-26T15:53:21.512762+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ddfce4b8-589b-49ff-9229-d976ec8e250c", "name": "pewter-mottled-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40924, "username": "faisal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:51:50.327883+00:00", "ended_at": "2026-08-26T15:51:51.487514+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "b77fbce6-d7da-4d0b-a1fe-19b7b7064541", "name": "drifting-deft-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 48776, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:51:25.801231+00:00", "ended_at": "2026-08-26T15:51:25.929970+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a2ad31f8-cab9-4d70-ab83-7a4617a0f383", "name": "nautical-quaint-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 45850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:49:29.057532+00:00", "ended_at": "2026-08-26T15:49:29.172905+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5b25c425-c234-4dc7-bda4-d6e2658d8df6", "name": "quartz-wiry-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40859, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:49:09.436344+00:00", "ended_at": "2026-08-26T15:49:10.787654+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "1b444083-57cf-4778-a14c-76648975a156", "name": "tender-subtle-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 42924, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:47:36.057350+00:00", "ended_at": "2026-08-26T15:47:36.221011+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "238c40fd-2f41-4e7b-8be5-5c55bffbf280", "name": "lofty-golden-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40856, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 751, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:46:24.778927+00:00", "ended_at": "2026-08-26T15:46:26.192802+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2220fa1b-4ebc-4e1c-985e-38a30505f26f", "name": "noble-verdant-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 40036, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:45:39.584962+00:00", "ended_at": "2026-08-26T15:45:39.740255+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "391f9677-2653-4db3-bd4c-af2edbbccea4", "name": "tangled-granite-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 37108, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:43:43.157628+00:00", "ended_at": "2026-08-26T15:43:43.261599+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "de87a9b3-8ed7-48d0-8e07-7d2f0a277e76", "name": "lunar-reedy-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40853, "username": "testftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:43:40.861951+00:00", "ended_at": "2026-08-26T15:43:42.043794+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "9c4e4740-c716-4a52-8bdb-b705a293efa0", "name": "gloomy-bold-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 34200, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:41:50.721301+00:00", "ended_at": "2026-08-26T15:41:50.838036+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8f7bd20e-1159-44f4-bb63-40cbc6eeec44", "name": "vaulted-umber-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40850, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:41:00.967613+00:00", "ended_at": "2026-08-26T15:41:02.413847+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "c3c87d0a-46e8-4877-b54d-6e41dfa984bc", "name": "ancient-hollow-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 59524, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:39:48.904658+00:00", "ended_at": "2026-08-26T15:39:49.036002+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2535591c-2b0a-4f61-a8ab-8cd924229163", "name": "stoic-fearless-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40847, "username": "ajay", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:38:13.799757+00:00", "ended_at": "2026-08-26T15:38:15.323567+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "fb806529-8002-4b9b-af2f-f309eb9d364f", "name": "chilly-bold-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 56578, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:37:44.291362+00:00", "ended_at": "2026-08-26T15:37:44.430015+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c6a733a6-96d7-42e7-a2c4-02203149f1a0", "name": "cosmic-fringed-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 53650, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:35:48.265510+00:00", "ended_at": "2026-08-26T15:35:48.389087+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9f12fbab-1ccd-4fa1-a657-08523aff9bde", "name": "arctic-glassy-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40844, "username": "odoo17", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:35:32.222507+00:00", "ended_at": "2026-08-26T15:35:33.337914+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "a2d2abe8-d3ea-49d2-ba1f-1f7ff6e28577", "name": "mindful-mossy-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 50718, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:34:00.146824+00:00", "ended_at": "2026-08-26T15:34:00.268233+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "37f93808-47b9-42b1-b362-d3e336edccf6", "name": "emerald-western-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40841, "username": "temp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:32:47.683960+00:00", "ended_at": "2026-08-26T15:32:49.494280+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "2f0f8446-1a0f-4940-a006-4c142d673018", "name": "stoic-upland-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 47816, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:32:12.618788+00:00", "ended_at": "2026-08-26T15:32:12.801265+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8496f10b-a571-4acc-9cb8-f06740851364", "name": "drifting-stoic-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 44896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:30:18.428770+00:00", "ended_at": "2026-08-26T15:30:18.533364+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6749b97d-7b2e-42a8-bdc8-99cfa995d58a", "name": "wooded-mellow-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40838, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:30:07.414904+00:00", "ended_at": "2026-08-26T15:30:08.845919+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "def075a2-788f-490b-9e9d-ebe81e275189", "name": "vigilant-mellow-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 41960, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:28:24.158370+00:00", "ended_at": "2026-08-26T15:28:24.275956+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cde989e9-5ca8-4956-b3d5-de0e287d64bf", "name": "regal-dusty-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40835, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:27:28.014575+00:00", "ended_at": "2026-08-26T15:27:29.715057+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "32baab97-a8be-400e-b595-c87becf2cb1f", "name": "wandering-upland-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 38980, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:26:28.847160+00:00", "ended_at": "2026-08-26T15:26:28.987208+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c6bd8dbf-abde-4be4-b73d-76100143e4e1", "name": "rugged-scarlet-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40832, "username": "acer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 751, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:24:37.976212+00:00", "ended_at": "2026-08-26T15:24:39.423750+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "7fc6a136-68f8-472d-a17e-f01bd88578f2", "name": "graceful-distant-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 36022, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:24:24.480105+00:00", "ended_at": "2026-08-26T15:24:24.584303+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "aa2b3bdb-41b1-40f7-a630-5bac28d1c9e3", "name": "rapid-bashful-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 33070, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:22:24.348249+00:00", "ended_at": "2026-08-26T15:22:24.454864+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3694e3c9-045c-4f39-b2d8-d8a17f1b9e01", "name": "inland-quartz-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40829, "username": "stperez", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:21:53.524429+00:00", "ended_at": "2026-08-26T15:21:55.142540+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "1532a5bf-4602-453b-aa5b-ccae9699776c", "name": "salty-sullen-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 58304, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:20:24.373040+00:00", "ended_at": "2026-08-26T15:20:24.506013+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "eabb46c1-d88e-42ec-91c4-8f9f201e4e05", "name": "gallant-nautical-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40826, "username": "ehsan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 754, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:19:07.570401+00:00", "ended_at": "2026-08-26T15:19:09.068552+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "7afe7d12-afbb-4a57-8d96-85692184fbfe", "name": "dewy-cobalt-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 55338, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:18:22.270073+00:00", "ended_at": "2026-08-26T15:18:22.416424+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "43c35472-6d7f-435a-abe5-a40ab6db6e36", "name": "frosty-nameless-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40823, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:16:28.241737+00:00", "ended_at": "2026-08-26T15:16:29.345554+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "338f00e2-3321-4065-9466-5cc2ed26dbd6", "name": "wooded-bold-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 52348, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:16:25.325781+00:00", "ended_at": "2026-08-26T15:16:25.436262+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b05fffd6-bd3b-4081-9b32-54b45825126f", "name": "russet-cosmic-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 49384, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:14:33.434532+00:00", "ended_at": "2026-08-26T15:14:33.542286+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cd14acdb-0532-4637-a57b-d4614e87e7b8", "name": "nimble-gritty-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40820, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:13:47.024035+00:00", "ended_at": "2026-08-26T15:13:48.740742+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "2506c4b8-96e2-43e2-9762-00c1218c60bd", "name": "hidden-indigo-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 61494, "username": "kim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:13:18.003964+00:00", "ended_at": "2026-08-26T15:13:19.483124+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "36504de0-ef0e-4a45-a1e1-fea053cae182", "name": "windswept-amber-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 46382, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:12:43.164467+00:00", "ended_at": "2026-08-26T15:12:43.284014+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b7e8f21d-e68e-4ba7-a684-1d1ce330c1a2", "name": "thawing-fleeting-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52494, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:11:24.442968+00:00", "ended_at": "2026-08-26T15:11:26.716417+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8a19b655-7d8b-4913-9ce0-f0eea4c236dc", "name": "velvet-spirited-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40817, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 754, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:11:09.396540+00:00", "ended_at": "2026-08-26T15:11:11.023513+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "cb0692cb-adfd-496e-b30e-83894b4ee50f", "name": "knotted-merry-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 43420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:10:55.636672+00:00", "ended_at": "2026-08-26T15:10:55.740348+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f881c2e4-7713-4c3b-ba41-1a562cac5584", "name": "scarlet-crisp-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 57610, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:09:33.162109+00:00", "ended_at": "2026-08-26T15:09:34.142292+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "763b57e9-8f95-4812-bd7c-30dc6f0505fb", "name": "downy-solar-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 40436, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:09:06.861734+00:00", "ended_at": "2026-08-26T15:09:06.968408+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3d81e16b-e9d4-4aac-a492-6a2552c55825", "name": "fleeting-shaded-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40814, "username": "usuario1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:08:27.168497+00:00", "ended_at": "2026-08-26T15:08:28.568238+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "897c001f-3537-4cf6-8ead-4f6972463db6", "name": "mindful-graceful-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56030, "username": "usuario1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:07:35.710506+00:00", "ended_at": "2026-08-26T15:07:37.163044+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "42614bb6-1bb8-4198-9f28-c73d3fe17766", "name": "craggy-upland-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 37428, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:07:09.334806+00:00", "ended_at": "2026-08-26T15:07:09.463495+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3c8a58e8-62e7-43b5-ad7c-8cf90e2d120e", "name": "regal-slender-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50998, "username": "syncuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:05:32.726271+00:00", "ended_at": "2026-08-26T15:05:34.184077+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "f3540827-ea8f-4166-b7dd-981ca9759f2d", "name": "coral-thrifty-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 34390, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:05:12.546057+00:00", "ended_at": "2026-08-26T15:05:12.701045+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0d61be63-1a1c-4452-9b14-fc7706e888d9", "name": "thorny-sincere-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40811, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 784, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:05:04.993523+00:00", "ended_at": "2026-08-26T15:05:06.290459+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "9a9314ef-938f-4455-a66f-2e10dba5a5a7", "name": "candid-feathered-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53630, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:03:37.292615+00:00", "ended_at": "2026-08-26T15:03:38.797555+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "4ff04a8c-a105-4708-a5b5-35ceb1798774", "name": "sullen-kindly-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 59566, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:03:14.480235+00:00", "ended_at": "2026-08-26T15:03:14.591596+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8bcdf282-e66a-4095-9db8-14fd6ca479e6", "name": "prairie-upland-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40808, "username": "postgres", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:01:57.463304+00:00", "ended_at": "2026-08-26T15:01:59.089304+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2273 }, { "id": "0848e902-05b2-401b-b626-d708e9461d50", "name": "tangled-prickly-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60838, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:01:36.456019+00:00", "ended_at": "2026-08-26T15:01:38.513231+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "12b87106-ca23-4459-a7f2-a017aac4a92e", "name": "marine-rambling-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.118.39.50", "src_port": 56478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T15:01:12.399491+00:00", "ended_at": "2026-08-26T15:01:12.843557+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2e5812ff-72c7-4cf4-b2d7-4a5331157272", "name": "tranquil-polar-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64610, "username": "seekcy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:59:39.928637+00:00", "ended_at": "2026-08-26T14:59:41.567115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2277 }, { "id": "6950cee9-b1b9-44ad-919f-ff2cce7095de", "name": "fabled-sincere-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40805, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 754, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:59:12.507667+00:00", "ended_at": "2026-08-26T14:59:13.746782+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e3ee7511-773d-41cf-8664-c3417c9f6ccf", "name": "bold-lonesome-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62892, "username": "sftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:57:38.476574+00:00", "ended_at": "2026-08-26T14:57:40.599679+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "897439c2-5925-438a-8b14-2eabc9021a13", "name": "fickle-bronzed-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40802, "username": "webuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:56:35.032491+00:00", "ended_at": "2026-08-26T14:56:36.307896+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "c6f68bac-2808-410e-8b8f-2d45cb853f27", "name": "opal-silent-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 63282, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:55:31.523076+00:00", "ended_at": "2026-08-26T14:55:33.134250+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "88233d8a-1dbe-4754-bff9-ef02dd88a432", "name": "prairie-northern-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40799, "username": "alexandre", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:53:53.004073+00:00", "ended_at": "2026-08-26T14:53:54.524521+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "68f114ed-7155-4e0c-b37b-46c2bf01d142", "name": "curious-umber-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53736, "username": "logviewer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:53:35.724921+00:00", "ended_at": "2026-08-26T14:53:37.263891+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "a5ea950c-51c3-4e1a-91ab-c3d39f9eae95", "name": "earnest-cosmic-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50314, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:51:34.958005+00:00", "ended_at": "2026-08-26T14:51:35.881700+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "c7314bfa-f3f5-4b8f-b033-8ec79289284e", "name": "austere-sincere-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 761, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:51:09.138548+00:00", "ended_at": "2026-08-26T14:51:10.441004+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b7490650-98ab-4412-ba2f-85d20b650a71", "name": "amiable-nautical-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64768, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:49:39.026323+00:00", "ended_at": "2026-08-26T14:49:40.174581+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b071e9c4-ac61-4511-9399-3afd4d66dcdb", "name": "proud-lively-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40731, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:48:13.256128+00:00", "ended_at": "2026-08-26T14:48:14.554042+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d33947eb-53b3-405c-91a6-f98649ff6c5c", "name": "scarlet-mellow-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 55332, "username": "promo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:47:42.878274+00:00", "ended_at": "2026-08-26T14:47:44.735311+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "79c82dc6-93a6-4f32-a42f-99c5dce541c0", "name": "jaunty-seaward-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52042, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:45:40.096591+00:00", "ended_at": "2026-08-26T14:45:41.726099+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "15f36d52-8e35-4540-ae3a-b8462d29a97e", "name": "pleasant-blunt-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40728, "username": "seekcy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:45:22.843666+00:00", "ended_at": "2026-08-26T14:45:24.423409+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2277 }, { "id": "51a1b668-fbdc-429a-b299-8f08552168f5", "name": "somber-hidden-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62084, "username": "alexandre", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:43:39.415312+00:00", "ended_at": "2026-08-26T14:43:41.429556+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "7598bea9-4da1-47d8-b026-d1a203a68e23", "name": "sincere-tender-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40725, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:42:31.000515+00:00", "ended_at": "2026-08-26T14:42:32.380142+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8cec4606-d4d9-4140-bc74-2b5a8e888a1a", "name": "scarlet-solar-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 51730, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:41:33.138217+00:00", "ended_at": "2026-08-26T14:41:34.797637+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "fb4ca0ef-db05-46c4-b9fe-4cb668151541", "name": "supple-quiet-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40722, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:39:42.710893+00:00", "ended_at": "2026-08-26T14:39:44.286402+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "573b33b6-3eae-458e-b5ca-03759bf9cb6d", "name": "loyal-dusty-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62216, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:39:21.006538+00:00", "ended_at": "2026-08-26T14:39:22.744954+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bdb39c75-9d9c-411a-a462-848f8b63369a", "name": "ashen-humble-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 58144, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:37:21.409105+00:00", "ended_at": "2026-08-26T14:37:22.312259+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "5ada0aaa-8ca6-459e-a378-738cee4e81d9", "name": "grassy-marbled-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40719, "username": "teamspeak", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:37:02.987773+00:00", "ended_at": "2026-08-26T14:37:04.629367+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2264 }, { "id": "89f9cf55-6093-45e0-a19e-bd2df5e61d1b", "name": "golden-frugal-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64812, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:35:22.389541+00:00", "ended_at": "2026-08-26T14:35:23.705048+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "89e6cbde-a1ab-4e25-bd9f-7903dd78048d", "name": "amiable-zealous-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46206, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 163, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:34:33.063869+00:00", "ended_at": "2026-08-26T14:34:38.705243+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7fc0bc7-d506-4935-bfd9-e21e65e3941e", "name": "hidden-murky-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37834, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 167, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:34:18.365444+00:00", "ended_at": "2026-08-26T14:34:21.383432+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d6bc292-5de0-4fdd-bd32-ac94c27cd299", "name": "stormy-feral-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41662, "username": "aaa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:34:18.285414+00:00", "ended_at": "2026-08-26T14:34:24.840858+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "24d89739-dec6-4187-8b9e-2e8bf306c2a3", "name": "jolly-sunlit-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40716, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:34:15.066072+00:00", "ended_at": "2026-08-26T14:34:16.782068+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "230be448-d7ac-4cab-a2af-d2e1925932c1", "name": "noble-tender-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47614, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 340, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:33:58.365597+00:00", "ended_at": "2026-08-26T14:34:03.225851+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e4babcea-c62b-4b14-ba6a-fbb90e39d975", "name": "austere-breezy-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35064, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:33:46.599348+00:00", "ended_at": "2026-08-26T14:33:49.333007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3f81e4ba-ed12-42fe-8dd3-2b8264bf23bc", "name": "burly-jaunty-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41088, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 432, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:33:32.802235+00:00", "ended_at": "2026-08-26T14:33:36.514437+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9480181a-9c50-41c9-87da-909c641bd03c", "name": "rambling-fearless-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38216, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:33:26.155615+00:00", "ended_at": "2026-08-26T14:33:31.909826+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eae6fba8-c3b6-4260-ab9a-2a5f3edb67d0", "name": "brave-austere-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56354, "username": "temp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:33:17.335120+00:00", "ended_at": "2026-08-26T14:33:18.473899+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "36aa25ed-924d-430f-8d51-4554eeebb004", "name": "woven-hidden-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57976, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 403, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:33:09.429144+00:00", "ended_at": "2026-08-26T14:33:13.037032+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fabbc092-2b87-4e92-bb5a-6d3399c28bc6", "name": "dappled-proud-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39442, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 493, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:32:52.717032+00:00", "ended_at": "2026-08-26T14:32:56.274019+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ab0fe243-2ae8-4009-acc7-f45ef1a211fa", "name": "valiant-hidden-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58026, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 398, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:32:45.690302+00:00", "ended_at": "2026-08-26T14:32:48.931822+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ab54c500-ec97-4754-8ee5-7c1dae727902", "name": "blunt-ashen-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42320, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 422, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:32:33.358677+00:00", "ended_at": "2026-08-26T14:32:38.652369+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e123cbab-cf40-456d-b41c-f8febe5ba36a", "name": "mottled-deft-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53854, "username": "ark", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 615, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:32:23.295465+00:00", "ended_at": "2026-08-26T14:32:35.615893+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "29917647-2ae4-4a02-893c-0b5c79472994", "name": "thawing-quaint-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57602, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:32:16.689938+00:00", "ended_at": "2026-08-26T14:32:21.338841+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6a190301-7866-43d7-ab3f-e1c97ee1511c", "name": "fleeting-pleasant-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57540, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 315, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:31:55.068605+00:00", "ended_at": "2026-08-26T14:31:57.714749+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2ad4691f-052c-4b27-a95e-b7e3a52994a1", "name": "bronzed-distant-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51536, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 385, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:31:48.280318+00:00", "ended_at": "2026-08-26T14:31:53.344178+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "faffdfda-db68-4f26-955b-e2d7f0083163", "name": "proud-vigilant-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40713, "username": "kamera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:31:31.396008+00:00", "ended_at": "2026-08-26T14:31:32.655176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "b120b8a6-d2ce-4c6c-b2f8-ffb8c8001570", "name": "granite-electric-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53112, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 487, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:31:29.897510+00:00", "ended_at": "2026-08-26T14:31:34.902769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "928457a2-2486-42be-8c4c-922add913a0b", "name": "genial-hazel-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43870, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 462, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:31:15.452743+00:00", "ended_at": "2026-08-26T14:31:20.616898+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2ecc14fe-0580-403a-af11-51c29521eb3e", "name": "cosmic-opal-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50718, "username": "testftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 303, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:31:13.259582+00:00", "ended_at": "2026-08-26T14:31:14.892471+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "4beb6a2a-b46e-4854-8d10-91508df80162", "name": "civil-shifting-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55836, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:31:07.745201+00:00", "ended_at": "2026-08-26T14:31:11.295696+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d5ba3d6d-decd-4cbe-b475-5cf78c22cc24", "name": "tangled-murky-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35496, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 533, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:30:53.167439+00:00", "ended_at": "2026-08-26T14:30:56.510440+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a80d3b39-4f00-4357-87bd-b6f5846ac83a", "name": "lively-ruddy-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34848, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:30:47.574725+00:00", "ended_at": "2026-08-26T14:30:51.843072+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e027010-5fca-420f-a9e3-6e7fd37242af", "name": "lively-dusky-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48200, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:30:22.967107+00:00", "ended_at": "2026-08-26T14:30:27.569640+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e9180e70-4775-44ff-8b7f-475cc412104f", "name": "vaulted-rugged-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38406, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:30:15.739108+00:00", "ended_at": "2026-08-26T14:30:20.740220+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "544215dd-1ee8-4bea-9681-9e6501e3033c", "name": "woven-painted-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38060, "username": "trade", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:30:00.907944+00:00", "ended_at": "2026-08-26T14:30:03.865584+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f9d3ea48-5f5c-4f25-b4be-7d5226e88b9b", "name": "slender-serene-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41660, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:29:40.653346+00:00", "ended_at": "2026-08-26T14:29:44.833287+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d3049eda-a723-440e-afe4-ac43274d4cd6", "name": "solemn-bronzed-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52282, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 404, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:29:34.001280+00:00", "ended_at": "2026-08-26T14:29:39.557597+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5e1b586f-23a0-4075-91dc-3fd50cf5465b", "name": "shaded-misty-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45464, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 379, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:29:23.474033+00:00", "ended_at": "2026-08-26T14:29:27.247010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6891adec-d205-41a9-baec-2f5a5e4d3213", "name": "reedy-opal-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 58170, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:29:20.135184+00:00", "ended_at": "2026-08-26T14:29:21.950257+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "4d476217-c2ee-4b23-9f58-780e03feaa14", "name": "flinty-coastal-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50134, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 380, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:29:11.783877+00:00", "ended_at": "2026-08-26T14:29:16.479465+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a71161e4-9d0e-41a1-b943-fe7641b0bb57", "name": "smooth-blunt-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34194, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:29:05.016516+00:00", "ended_at": "2026-08-26T14:29:10.849057+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f18750f-a2f4-45a6-b0e1-ece97269d423", "name": "dappled-murky-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50574, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:28:49.959406+00:00", "ended_at": "2026-08-26T14:28:55.299109+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff4efb31-451f-4f12-8170-a5b2cabaa09e", "name": "arctic-solemn-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39276, "username": "airflow", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 416, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:28:44.667385+00:00", "ended_at": "2026-08-26T14:28:52.738674+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "6f3f2e48-327e-409c-8bb4-cc94fec84ebd", "name": "civil-flinty-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40710, "username": "yangx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:28:41.209628+00:00", "ended_at": "2026-08-26T14:28:42.598668+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "7b035cf8-8574-4aff-bd1f-249c9bbac714", "name": "airy-humble-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59034, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:28:19.328317+00:00", "ended_at": "2026-08-26T14:28:22.851891+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bec2a270-30b9-48a9-bd78-d67b13b66fc6", "name": "mottled-alpine-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57344, "username": "ossuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 420, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:28:18.202809+00:00", "ended_at": "2026-08-26T14:28:27.086640+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1665 }, { "id": "f682057d-082b-40ba-9270-738235b9ebf7", "name": "serene-crisp-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52592, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 436, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:27:59.479547+00:00", "ended_at": "2026-08-26T14:28:04.033163+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c0aedf36-4a7e-429b-bf14-d019b5165537", "name": "proud-brazen-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49418, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 603, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:27:43.828699+00:00", "ended_at": "2026-08-26T14:27:48.822075+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74ea568c-6a83-4cd3-a8d8-dd3ae3768d7d", "name": "airy-cobalt-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52172, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 437, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:27:30.890491+00:00", "ended_at": "2026-08-26T14:27:36.307766+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bed0f065-88a9-4511-b220-7486a531d149", "name": "jolly-brisk-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64060, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:27:19.683969+00:00", "ended_at": "2026-08-26T14:27:21.927711+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "3bb1f8a6-8034-48d1-975f-7f76fac2a571", "name": "indigo-sullen-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39376, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:27:10.447819+00:00", "ended_at": "2026-08-26T14:27:14.242637+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ac10f55-1855-4fa5-a857-2d63e23d2759", "name": "craggy-marbled-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44766, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 680, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:27:03.669815+00:00", "ended_at": "2026-08-26T14:27:08.531181+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c046a416-f0bb-4c07-9dd7-913cfa23577c", "name": "plucky-jagged-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39486, "username": "kali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:26:46.449217+00:00", "ended_at": "2026-08-26T14:26:56.045083+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "505181a3-18f9-4e8f-b8d1-8b4b236af165", "name": "quaint-wistful-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33748, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 420, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:26:42.593162+00:00", "ended_at": "2026-08-26T14:26:46.157007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d62e6ebb-fced-4a5a-bcfa-0d0ffb04ec5d", "name": "feral-sooty-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59304, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 435, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:26:21.097271+00:00", "ended_at": "2026-08-26T14:26:24.763854+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4bc4cba9-dfe7-4b82-afc9-843c37afd51e", "name": "oaken-verdant-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60562, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 437, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:26:15.496909+00:00", "ended_at": "2026-08-26T14:26:21.040773+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1c92809e-c1ee-4750-b91d-798c4e91b33f", "name": "tangled-forlorn-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40520, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 675, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:25:57.359798+00:00", "ended_at": "2026-08-26T14:26:03.575604+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6db6a079-e5ba-43a2-9b1b-6773fc1a40c7", "name": "placid-proud-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40707, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:25:56.614579+00:00", "ended_at": "2026-08-26T14:25:57.789293+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "79e79495-f9a2-45d2-8c28-14dc404fcf0d", "name": "hollow-sleepy-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44688, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 615, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:25:41.071706+00:00", "ended_at": "2026-08-26T14:25:44.988005+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7cfed30-fc33-443d-9e34-61d05e271592", "name": "regal-shaded-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55748, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 739, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:25:32.502125+00:00", "ended_at": "2026-08-26T14:25:36.533861+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1ebbb7f1-d5fc-490f-9b3f-11e5171af2f9", "name": "loyal-flinty-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50212, "username": "webuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:25:22.761801+00:00", "ended_at": "2026-08-26T14:25:24.511576+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "ba6b13aa-ae6c-4393-b845-d8ed56a543bb", "name": "patient-rambling-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36260, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 479, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:25:22.308572+00:00", "ended_at": "2026-08-26T14:25:26.534182+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "056ee6a7-8e75-4c0c-b913-e2783891a50d", "name": "steady-wry-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43962, "username": "admins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 520, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:25:18.210186+00:00", "ended_at": "2026-08-26T14:25:30.112574+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6e8a8903-9eac-48b5-a557-e69416b3e11e", "name": "supple-lanky-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52086, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 346, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:24:49.548490+00:00", "ended_at": "2026-08-26T14:24:55.057452+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2df56862-5a2d-4ea7-b295-6426b5a633c0", "name": "feral-feathered-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37466, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:24:48.226801+00:00", "ended_at": "2026-08-26T14:24:52.184333+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "21b667d1-e233-49a3-a859-78174f9915d4", "name": "gritty-proud-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45050, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:24:28.152006+00:00", "ended_at": "2026-08-26T14:24:33.154236+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4d578299-b9e6-42a6-af0d-03b227bdf6bd", "name": "blunt-nautical-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47676, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 392, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:24:17.579177+00:00", "ended_at": "2026-08-26T14:24:21.417644+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "52c6b3da-5e86-4e44-aea6-46ed653b4136", "name": "arctic-daring-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55890, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 400, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:23:59.537428+00:00", "ended_at": "2026-08-26T14:24:05.832853+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "50795711-7d35-449f-bc23-252841b31253", "name": "cosmic-forlorn-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46104, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 519, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:23:55.588927+00:00", "ended_at": "2026-08-26T14:24:00.159294+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b94d094-0e52-4124-8015-2f80826bef02", "name": "seaward-regal-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56750, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 706, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:23:36.931421+00:00", "ended_at": "2026-08-26T14:23:42.804501+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5959ec85-c565-4cb4-8b3b-617f97346060", "name": "brisk-flinty-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51284, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:23:25.691851+00:00", "ended_at": "2026-08-26T14:23:29.691769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da7a776d-37a1-4814-9fd8-c934d2057490", "name": "slender-tawny-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60544, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:23:21.970160+00:00", "ended_at": "2026-08-26T14:23:23.893045+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "12ca0e62-5382-4a17-8063-61c6039b626d", "name": "obsidian-creaky-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44208, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 340, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:23:14.604509+00:00", "ended_at": "2026-08-26T14:23:20.219739+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ea26497e-3ab0-48fd-829a-52c184be61b0", "name": "russet-hazel-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40704, "username": "developer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:23:12.910086+00:00", "ended_at": "2026-08-26T14:23:14.585682+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2233 }, { "id": "439f0471-3ee3-4bbf-955c-aa71f55f4194", "name": "dewy-shaded-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46132, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 558, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:23:02.822426+00:00", "ended_at": "2026-08-26T14:23:07.684423+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "172ed11b-88fe-46c2-99a8-623ebb6acebb", "name": "pewter-cheerful-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37508, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 401, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:22:48.338034+00:00", "ended_at": "2026-08-26T14:22:54.065346+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7dc93d2e-df74-435f-9bf8-80075f876af3", "name": "sunlit-whispering-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58066, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:22:43.801545+00:00", "ended_at": "2026-08-26T14:22:57.910661+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "55817f52-84df-47ca-837c-e2fb7b7dbf27", "name": "sooty-fierce-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60316, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:22:18.147636+00:00", "ended_at": "2026-08-26T14:22:23.664291+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d3b87bd7-01ad-40d1-a565-748d4dbb6aa5", "name": "painted-rustic-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59424, "username": "gabriel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:22:13.476899+00:00", "ended_at": "2026-08-26T14:22:23.933961+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "8f9f036c-7b08-4508-b4d9-db9638cea3b2", "name": "somber-hazel-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44064, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:21:53.589192+00:00", "ended_at": "2026-08-26T14:21:57.581623+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d90b873-3f56-424f-ad44-104913f07bb8", "name": "clever-verdant-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56776, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 466, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:21:44.978764+00:00", "ended_at": "2026-08-26T14:21:49.932664+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2bdf8bcb-bc6f-4f91-ab5a-23acc92746e4", "name": "woven-ashen-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39204, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:21:37.258848+00:00", "ended_at": "2026-08-26T14:21:40.763025+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12012469-186c-4341-9072-1f9e5505bed6", "name": "dappled-sullen-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35712, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 509, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:21:17.995890+00:00", "ended_at": "2026-08-26T14:21:21.678515+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da7d9251-1811-4279-b07c-312524051816", "name": "glassy-forlorn-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60904, "username": "odoo17", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:21:13.030885+00:00", "ended_at": "2026-08-26T14:21:14.884521+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "bbb84a99-c70d-4c3c-abc4-23fe2a29c7f5", "name": "frosty-whispering-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46254, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 623, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:21:05.017012+00:00", "ended_at": "2026-08-26T14:21:10.079463+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "79efa4b0-c1db-4061-9a24-c59e47774ddb", "name": "dusty-courtly-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56926, "username": "mc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 501, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:20:54.194613+00:00", "ended_at": "2026-08-26T14:20:58.715393+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "23b90971-d31a-4b5c-a920-d261dd86b2a8", "name": "vivid-arctic-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60428, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 671, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:20:38.137565+00:00", "ended_at": "2026-08-26T14:20:41.069364+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1bb6ca7f-6d13-46bf-9ac5-76a61fad7b29", "name": "hidden-wry-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49956, "username": "Asalem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 686, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:20:37.440910+00:00", "ended_at": "2026-08-26T14:20:46.982423+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5c5877b0-9da7-4d45-97ba-2a6981f8117e", "name": "diligent-ivory-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40701, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:20:30.024042+00:00", "ended_at": "2026-08-26T14:20:31.672634+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "af012c5a-8e5b-47dd-a8b1-e259f645201e", "name": "orderly-humble-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57286, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 467, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:20:12.188176+00:00", "ended_at": "2026-08-26T14:20:15.768004+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49ac85c1-d584-440d-affd-bbdb244e3134", "name": "drifting-peaty-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36476, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:20:03.017616+00:00", "ended_at": "2026-08-26T14:20:08.871478+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34e375fe-4d6e-472b-9a09-e54868e6dfb0", "name": "solar-fleeting-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36184, "username": "mohammad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 521, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:20:01.884640+00:00", "ended_at": "2026-08-26T14:20:15.523686+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "101ae40c-2816-4dbf-91f9-1181b533fdf0", "name": "cunning-ancient-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60632, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 674, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:19:35.254566+00:00", "ended_at": "2026-08-26T14:19:40.532276+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8b3281d1-cf7f-4113-a3f6-6306b6929121", "name": "ashen-earnest-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37032, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 603, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:19:21.747874+00:00", "ended_at": "2026-08-26T14:19:26.974278+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86a35e29-1a47-4b18-b09c-39cd181c00b0", "name": "bronzed-whispering-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64336, "username": "developer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:19:20.933243+00:00", "ended_at": "2026-08-26T14:19:22.363330+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2266 }, { "id": "c0f82510-a2e6-4570-9e04-f06757d89f4d", "name": "quaint-obsidian-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44422, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 581, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:19:08.364684+00:00", "ended_at": "2026-08-26T14:19:13.937757+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c480ea2-fb11-4f9c-a97a-5eaaf84d5071", "name": "gilded-hushed-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43594, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:18:50.537151+00:00", "ended_at": "2026-08-26T14:18:55.700224+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12083888-325d-4470-a9c9-025caa25911d", "name": "genial-earnest-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37360, "username": "ghost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:18:45.025017+00:00", "ended_at": "2026-08-26T14:18:54.806180+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "30267b78-69c4-4822-9b8f-7f1ef9c594ba", "name": "velvet-fearless-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47138, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 410, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:18:31.704830+00:00", "ended_at": "2026-08-26T14:18:37.100713+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "14544ef6-e5ea-4e6d-8936-3ff5f8358cc3", "name": "marbled-balmy-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59988, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 553, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:18:17.880186+00:00", "ended_at": "2026-08-26T14:18:23.308125+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "81465ab7-24d7-40b2-8f51-08043a7ec1c5", "name": "solar-freckled-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55432, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 642, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:18:05.060325+00:00", "ended_at": "2026-08-26T14:18:17.250052+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "5208b474-bff3-4f35-84da-2fc2c3be89c8", "name": "snowy-hearty-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58760, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 788, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:18:03.206099+00:00", "ended_at": "2026-08-26T14:18:07.775085+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2cb77e3-5717-4532-97d7-953fcf646c32", "name": "cosmic-frank-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40698, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:17:49.196284+00:00", "ended_at": "2026-08-26T14:17:50.752858+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "1735069d-a243-479f-a91d-451019970bbd", "name": "marine-slender-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36794, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:17:45.552885+00:00", "ended_at": "2026-08-26T14:17:55.112958+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0afc9505-9009-4d23-8b78-1a69a0f6866c", "name": "sunlit-coral-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53024, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 494, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:17:29.067775+00:00", "ended_at": "2026-08-26T14:17:34.386047+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6fb8a986-c94b-4ba3-a74b-16ab5b06a5d7", "name": "dappled-ruddy-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44464, "username": "tactical", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 675, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:17:27.652458+00:00", "ended_at": "2026-08-26T14:17:42.725370+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "bbe057e8-b0ac-47a8-9558-f4834431a731", "name": "jolly-vivid-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64410, "username": "tu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:17:27.267550+00:00", "ended_at": "2026-08-26T14:17:29.291001+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "3ec9a754-774d-40c6-b229-f89fe2099e8c", "name": "dusky-knotted-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44762, "username": "fivem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 867, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:17:07.176519+00:00", "ended_at": "2026-08-26T14:17:22.671596+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "1f084ea4-eccb-42e7-90e6-c7bf23eea3f5", "name": "weathered-fabled-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52850, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 546, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:17:03.751495+00:00", "ended_at": "2026-08-26T14:17:07.224475+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2705e39b-e3bb-4132-b28b-cd4ba31ecead", "name": "restless-sincere-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56596, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 680, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:16:43.312045+00:00", "ended_at": "2026-08-26T14:16:46.644369+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8ce4b2bb-de1b-4962-ba49-2ed97b67e16b", "name": "slender-velvet-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44946, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:16:27.842289+00:00", "ended_at": "2026-08-26T14:16:31.987685+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f6df96d0-7905-42d3-9931-48fac37e7d51", "name": "fleeting-blithe-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50876, "username": "codex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:16:24.033809+00:00", "ended_at": "2026-08-26T14:16:46.043350+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "abf53c81-44e0-4c35-91a1-4022687c4c39", "name": "solar-ivory-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41394, "username": "wso2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:15:59.734366+00:00", "ended_at": "2026-08-26T14:16:11.720511+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "5475cea5-947e-444b-ac00-1513d0719292", "name": "polar-blazing-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42334, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 418, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:15:56.301187+00:00", "ended_at": "2026-08-26T14:16:01.739180+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6118fd8d-bdea-40f5-9053-ebd4253607ce", "name": "frugal-russet-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58788, "username": "niaoyun", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 533, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:15:36.421092+00:00", "ended_at": "2026-08-26T14:15:48.812768+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f82a9f8f-5da6-4f38-ac45-0998b2c47e27", "name": "russet-curious-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 51294, "username": "minecraft", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:15:26.998405+00:00", "ended_at": "2026-08-26T14:15:28.445703+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "87d35ca3-e340-4e23-943e-89a4ea81cc1a", "name": "gleaming-oaken-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54910, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 477, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:15:17.209349+00:00", "ended_at": "2026-08-26T14:15:20.137913+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04eff89a-84ae-47bf-b023-3ff1ab44646f", "name": "deft-somber-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60050, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 378, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:15:04.246449+00:00", "ended_at": "2026-08-26T14:15:09.863761+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fc9f9b7a-73ed-4e25-b154-07bbf020566e", "name": "peaty-clever-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40695, "username": "logviewer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:14:58.829455+00:00", "ended_at": "2026-08-26T14:15:00.108082+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2190 }, { "id": "216c5e33-0c3e-4520-94cf-48296622e82d", "name": "ginger-regal-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54876, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:14:51.690218+00:00", "ended_at": "2026-08-26T14:14:55.663656+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "371da9ab-39d1-41e4-9bfb-025351a11186", "name": "brave-arctic-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50246, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 392, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:14:42.287342+00:00", "ended_at": "2026-08-26T14:14:46.180344+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0a1eee2-c10a-46c7-a3c9-d957be8791f3", "name": "placid-knotted-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38602, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 692, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:14:29.567448+00:00", "ended_at": "2026-08-26T14:14:34.933138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bb701d4-00f8-44b2-bf16-e2bb13191a23", "name": "rapid-balmy-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54606, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:14:21.311418+00:00", "ended_at": "2026-08-26T14:14:27.142069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ab786837-6d8a-442b-80f8-b9623e54aa28", "name": "thorny-gentle-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59394, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:14:01.893266+00:00", "ended_at": "2026-08-26T14:14:06.232629+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a6767ddb-65e2-4455-a758-47a697175ab6", "name": "dapper-russet-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34848, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 851, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:13:53.676589+00:00", "ended_at": "2026-08-26T14:13:57.090563+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d1e6c2fa-0c9d-4a5c-a6e8-6f450b96e13d", "name": "rugged-hushed-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50364, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 646, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:13:43.567397+00:00", "ended_at": "2026-08-26T14:13:47.469575+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d6850ee4-e596-4dfe-b439-5bf49678028b", "name": "shaded-glacial-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35084, "username": "factorio", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 860, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:13:37.458941+00:00", "ended_at": "2026-08-26T14:13:50.684922+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "acda9d81-3085-402c-a846-bf495d93396f", "name": "jaunty-thrifty-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52142, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:13:31.530033+00:00", "ended_at": "2026-08-26T14:13:32.561998+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "0d3177a2-8bf4-4cc3-996a-c1aca49ce3c9", "name": "wandering-mellow-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52334, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:13:12.087945+00:00", "ended_at": "2026-08-26T14:13:15.885065+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c610b27b-0e8b-46c3-aac7-00073cc6645e", "name": "plush-nimble-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44904, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 694, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:13:08.030907+00:00", "ended_at": "2026-08-26T14:13:19.029392+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "1f284605-c54e-4ea0-9924-e2af1715a412", "name": "orderly-western-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50334, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:12:46.202324+00:00", "ended_at": "2026-08-26T14:12:51.294484+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8dcc611b-16eb-45fd-814b-78505fdd62fa", "name": "verdant-hollow-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45006, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 679, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:12:40.942196+00:00", "ended_at": "2026-08-26T14:12:44.900213+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac736e7c-8f8a-45f7-97a3-674832e428ad", "name": "bitter-feral-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38404, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 774, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:12:28.196834+00:00", "ended_at": "2026-08-26T14:12:34.127877+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dc54fef6-c1b6-4735-84c1-9064ac437ba5", "name": "jaunty-opal-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40692, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:12:15.613953+00:00", "ended_at": "2026-08-26T14:12:17.079002+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2180 }, { "id": "cb8d2214-2e68-4651-a51f-8fb35195e41f", "name": "idle-keen-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35806, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 789, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:12:14.143095+00:00", "ended_at": "2026-08-26T14:12:16.796248+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db120508-d130-415b-ad84-e86ece9e3b88", "name": "cosmic-quaint-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49292, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 417, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:12:06.959564+00:00", "ended_at": "2026-08-26T14:12:11.242109+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "65cef20f-7eb9-4a70-9291-688a5b8720f2", "name": "windswept-lanky-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57914, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:11:47.686468+00:00", "ended_at": "2026-08-26T14:11:52.553629+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d96ac90-5974-45be-b7f5-5ffa7e68cb17", "name": "tangled-calm-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60106, "username": "kamera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:11:36.498686+00:00", "ended_at": "2026-08-26T14:11:38.123035+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2231 }, { "id": "f923badc-8501-46b4-8188-005d8fee8b40", "name": "autumn-gnarled-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49300, "username": "admin123", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 649, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:11:36.206566+00:00", "ended_at": "2026-08-26T14:11:47.144202+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "50b2e44e-1add-47bb-a01e-cd9345e324d2", "name": "blunt-honest-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47898, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:11:35.177028+00:00", "ended_at": "2026-08-26T14:11:37.966136+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5e8fab42-25e9-41a5-9014-874d7b9df6aa", "name": "somber-obsidian-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51380, "username": "sedu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 668, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:11:12.600021+00:00", "ended_at": "2026-08-26T14:11:25.066055+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "79fef993-752c-4c36-a6db-5cff21ba2bae", "name": "gallant-meadow-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36762, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 652, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:11:12.342336+00:00", "ended_at": "2026-08-26T14:11:18.356373+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2aad29b-93f1-43b0-b878-a0dac57d99a1", "name": "ginger-restless-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57924, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1044, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:10:53.422386+00:00", "ended_at": "2026-08-26T14:10:56.408314+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eaab0f24-26c7-4f4a-b903-4c0c1db0a91f", "name": "creaky-forlorn-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57572, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 737, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:10:40.930283+00:00", "ended_at": "2026-08-26T14:10:46.423018+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "459afb2a-e373-4084-924d-10127ddbad92", "name": "idle-frugal-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48998, "username": "odoo14", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:10:31.793267+00:00", "ended_at": "2026-08-26T14:10:44.458673+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8c4ceb4f-500d-4e73-b3de-9b48a86ae4a2", "name": "glassy-distant-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54306, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 893, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:10:23.009092+00:00", "ended_at": "2026-08-26T14:10:28.855446+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e5549245-0a60-4fcc-bf89-565bb2136776", "name": "gentle-courtly-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45274, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 991, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:10:12.584372+00:00", "ended_at": "2026-08-26T14:10:18.710726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "634d2bd0-35c9-404c-a395-afab209d7a51", "name": "nimble-cunning-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35744, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 595, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:09:56.304320+00:00", "ended_at": "2026-08-26T14:10:00.460395+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "46553744-8189-4d44-8111-95f8ceb1aa7d", "name": "bitter-spirited-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57198, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 826, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:09:55.728313+00:00", "ended_at": "2026-08-26T14:10:00.785046+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "396b9fff-694c-4c64-8b90-e6082ff6d021", "name": "hazy-woven-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56820, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 781, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:09:39.545082+00:00", "ended_at": "2026-08-26T14:09:43.432191+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db49389f-e9af-48c0-b6d4-0fc84d1a87c9", "name": "reedy-velvet-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 54270, "username": "stperez", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:09:35.058137+00:00", "ended_at": "2026-08-26T14:09:36.003043+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2219 }, { "id": "ea781c7b-5ef2-4f48-b3bc-cabfcbbded07", "name": "dappled-idle-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44966, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1100, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:09:27.715352+00:00", "ended_at": "2026-08-26T14:09:32.570192+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "16756dba-eced-4e87-ba27-3280597f30d3", "name": "hazel-frank-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55868, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 954, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:09:24.196249+00:00", "ended_at": "2026-08-26T14:09:27.164028+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "98ec9487-31d4-4515-8367-f0bbe33257ec", "name": "eager-polar-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40689, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:09:21.961709+00:00", "ended_at": "2026-08-26T14:09:22.996074+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "d6c11ba9-b0b1-473e-896f-02af63b5661a", "name": "deft-distant-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38584, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1163, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:09:03.033392+00:00", "ended_at": "2026-08-26T14:09:06.875607+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bab73416-6db3-40c7-98e2-ca1abdc06717", "name": "polar-jaunty-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57156, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:08:59.033160+00:00", "ended_at": "2026-08-26T14:09:04.545188+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1dffc5a8-d16d-4660-b3c5-bac177c6c11a", "name": "brisk-russet-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40600, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1119, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:08:43.803025+00:00", "ended_at": "2026-08-26T14:09:05.393994+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "dd0a0334-afa5-43ef-8de7-7f210a332987", "name": "crisp-upland-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35786, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 760, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:08:24.287740+00:00", "ended_at": "2026-08-26T14:08:29.858427+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2cb45178-cfcb-40e2-8eb9-dec9559a6f61", "name": "distant-tender-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53078, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 481, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:08:05.237274+00:00", "ended_at": "2026-08-26T14:08:11.072958+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49a673a9-9dea-41ae-b39b-c1c4e6309b91", "name": "cobalt-hearty-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55574, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 392, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:07:52.926878+00:00", "ended_at": "2026-08-26T14:07:56.713945+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e43b6d1-5394-424c-b0cd-0593295da0f2", "name": "dewy-downy-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58300, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 389, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:07:43.671985+00:00", "ended_at": "2026-08-26T14:07:50.193881+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30625244-bc14-41e8-83cb-6ac9e9114167", "name": "amiable-plucky-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57130, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 380, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:07:35.988879+00:00", "ended_at": "2026-08-26T14:07:39.945258+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aaa9f130-70a8-4358-ae68-b8e76e8598cc", "name": "blunt-gloomy-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 65004, "username": "gpadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:07:32.660122+00:00", "ended_at": "2026-08-26T14:07:33.692080+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2208 }, { "id": "9e795b7c-a0f6-493e-acaa-87b1cf70bd9f", "name": "opal-flinty-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53242, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 422, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:07:13.987108+00:00", "ended_at": "2026-08-26T14:07:18.144760+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "104e36ac-664c-4831-8852-3beb9068f6b1", "name": "oaken-bronzed-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45770, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 533, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:07:06.570347+00:00", "ended_at": "2026-08-26T14:07:12.180056+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3bb51dc5-c218-45d8-a153-1c5eff85ff82", "name": "downy-regal-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35646, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 694, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:06:46.147762+00:00", "ended_at": "2026-08-26T14:06:51.884648+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e92cb958-fb8f-40cb-bd28-adcfbe718e80", "name": "jovial-wry-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51206, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 519, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:06:39.001129+00:00", "ended_at": "2026-08-26T14:06:43.250126+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd9a2d06-cbd9-4c52-ac45-d1478eacca0e", "name": "amber-knotted-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40686, "username": "minecraft", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:06:38.245229+00:00", "ended_at": "2026-08-26T14:06:39.380787+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2157 }, { "id": "a243b7ca-5505-4f62-a360-bc2fe4f6fe1d", "name": "wooded-frugal-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54780, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 673, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:06:26.075047+00:00", "ended_at": "2026-08-26T14:06:30.460687+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f0d6f964-5b30-48ce-a9b3-9045f175f30a", "name": "noble-fickle-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34322, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 549, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:06:03.537802+00:00", "ended_at": "2026-08-26T14:06:08.055525+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58273d2a-146c-41b5-8a1c-c9ed8612ee8d", "name": "lawful-humble-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60588, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 585, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:05:52.524187+00:00", "ended_at": "2026-08-26T14:05:58.407584+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "312a7036-f9c8-46ed-88f7-7c882ef6b204", "name": "burly-mossy-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45444, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 672, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:05:43.402130+00:00", "ended_at": "2026-08-26T14:05:46.371269+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2645b9f-d378-472b-9fde-f069db9e2d59", "name": "nautical-craggy-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33284, "username": "webmaster", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 727, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:05:39.113836+00:00", "ended_at": "2026-08-26T14:05:51.209736+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "2489171e-e757-466b-9b39-4c81f7353a5f", "name": "wooded-brisk-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56130, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:05:33.591848+00:00", "ended_at": "2026-08-26T14:05:35.149922+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "ad401ad7-638a-4764-8ef3-e18b6185ee42", "name": "freckled-obsidian-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35858, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 610, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:05:08.914789+00:00", "ended_at": "2026-08-26T14:05:12.895218+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c1043255-0616-44c7-80e9-53d2df107d21", "name": "distant-zealous-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39286, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 487, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:04:54.135341+00:00", "ended_at": "2026-08-26T14:04:59.695569+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e08661f7-df36-4d7d-b9ec-275c81a56e80", "name": "canny-grassy-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53398, "username": "parsa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:04:52.069796+00:00", "ended_at": "2026-08-26T14:05:03.094638+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "484ccf28-10ab-4bf7-8148-770e267bad6a", "name": "frugal-silent-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56494, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 596, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:04:29.546683+00:00", "ended_at": "2026-08-26T14:04:34.768412+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5862b6b9-cd93-4726-b149-14607123f396", "name": "jaunty-hidden-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32962, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 687, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:04:24.725520+00:00", "ended_at": "2026-08-26T14:04:29.413551+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "218c0bd5-c0aa-40c4-a3b0-79db844fae7b", "name": "icy-upland-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36440, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 701, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:04:10.726939+00:00", "ended_at": "2026-08-26T14:04:15.687986+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9952d254-ff5c-4993-b3a8-180ce6794e2b", "name": "gleaming-murky-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39752, "username": "bitrix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:04:00.823904+00:00", "ended_at": "2026-08-26T14:04:12.210574+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d12178bb-980f-4778-8944-973f7a7ca9d9", "name": "peaty-ivory-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38188, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:03:48.851612+00:00", "ended_at": "2026-08-26T14:03:52.427340+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74535db9-1421-4ea7-b347-87408f6fda5a", "name": "brisk-rustic-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58454, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 721, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:03:38.703925+00:00", "ended_at": "2026-08-26T14:03:45.051619+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f3d1d3c-f051-44e5-b47e-b55406fe1d31", "name": "dapper-barren-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40683, "username": "pixel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:03:29.804588+00:00", "ended_at": "2026-08-26T14:03:30.806226+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2140 }, { "id": "e2b4b756-6462-49fb-ae83-fbcb35286ae4", "name": "honest-icy-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52380, "username": "ehsan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:03:29.803087+00:00", "ended_at": "2026-08-26T14:03:30.720604+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2184 }, { "id": "c6799d07-524f-41ad-8452-b411cb6ed33b", "name": "pleasant-sleepy-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58404, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 422, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:03:29.590164+00:00", "ended_at": "2026-08-26T14:03:45.421333+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "52d54982-8c24-4a41-90b2-7ab3820dda9f", "name": "merry-twilight-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52616, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:03:17.466738+00:00", "ended_at": "2026-08-26T14:03:20.729374+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "88c5bd98-f57b-4137-8598-c2f5d4242a0f", "name": "knotted-mindful-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60844, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1109, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:03:01.399812+00:00", "ended_at": "2026-08-26T14:03:04.394556+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "296783d4-df0c-4b4c-a344-60c8fe447a5c", "name": "ashen-deft-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 914, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:02:57.042014+00:00", "ended_at": "2026-08-26T14:03:02.089367+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9f5739b-c72a-411a-933f-b0a38b74e3c4", "name": "lawful-knotted-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59276, "username": "jack", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:02:47.705112+00:00", "ended_at": "2026-08-26T14:02:58.372380+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "98980c1e-6ad7-4382-8b9a-696d5b3fb390", "name": "subtle-shifting-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57484, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 478, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:02:28.795793+00:00", "ended_at": "2026-08-26T14:02:34.197379+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a3a26b2e-f034-447d-8508-8718df958315", "name": "chilly-forlorn-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56990, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 671, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:02:18.406938+00:00", "ended_at": "2026-08-26T14:02:22.659711+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "857f50c5-814b-4806-b5b2-c7ba2b2335bb", "name": "jagged-muted-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 535, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:02:06.821351+00:00", "ended_at": "2026-08-26T14:02:11.847683+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da5b5e40-afac-4556-8f3f-bdfb70278b32", "name": "kindly-dusky-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50214, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 475, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:02:01.710419+00:00", "ended_at": "2026-08-26T14:02:04.971146+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ea4e8c4a-38cf-4817-9956-9f020d3998f1", "name": "calm-polar-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 644, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:01:46.945227+00:00", "ended_at": "2026-08-26T14:01:52.154403+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db43ab5a-1665-4a32-a43c-305b47e2259a", "name": "dappled-vigilant-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56010, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 675, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:01:39.714548+00:00", "ended_at": "2026-08-26T14:01:45.306465+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b420018-126a-46e8-b24f-51c87043de91", "name": "autumn-amiable-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62728, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:01:35.432864+00:00", "ended_at": "2026-08-26T14:01:36.957850+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2227 }, { "id": "2b1cf4aa-e35f-48db-861e-6118de8eafe2", "name": "mottled-lonesome-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60326, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 639, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:01:31.615153+00:00", "ended_at": "2026-08-26T14:01:34.712074+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "02fbc0a0-ed18-42cc-8d5c-8d8cd8facb89", "name": "kindly-orderly-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49798, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1369, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:01:22.020133+00:00", "ended_at": "2026-08-26T14:01:28.024437+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "defdc84a-81b5-43a5-a985-b173c3b480e8", "name": "jaunty-scarlet-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51808, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:01:11.772295+00:00", "ended_at": "2026-08-26T14:01:16.170138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28e426f9-a600-43a5-a031-f127cab51fa4", "name": "twilight-calm-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38152, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:00:59.254467+00:00", "ended_at": "2026-08-26T14:01:02.863899+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30db74f5-79a5-4ca9-a2a4-22cd2d389aa2", "name": "nautical-emerald-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40680, "username": "syncuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:00:51.104083+00:00", "ended_at": "2026-08-26T14:00:52.317010+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "0cef3771-3368-4a98-8182-b16e75b51fe3", "name": "wry-rambling-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51610, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1398, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:00:49.929764+00:00", "ended_at": "2026-08-26T14:00:54.937997+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "99ba69b8-2a4a-4a2b-b0d3-d58c2284a804", "name": "gilded-sturdy-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32820, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1494, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:00:38.266484+00:00", "ended_at": "2026-08-26T14:00:43.258477+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "83e16068-3782-4499-ad71-c1527b23a52e", "name": "sleepy-keen-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32794, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:00:33.560083+00:00", "ended_at": "2026-08-26T14:00:39.859727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10653991-16e8-4f25-8495-6fa2444c864c", "name": "amiable-grassy-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37236, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1080, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:00:21.962087+00:00", "ended_at": "2026-08-26T14:00:26.917413+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e44a9f62-a473-4f7e-a9ab-bb706ab95438", "name": "crystal-fierce-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39626, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 667, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T14:00:03.281678+00:00", "ended_at": "2026-08-26T14:00:11.044740+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a4f838cd-8739-444a-a805-f03973ba16dd", "name": "serene-creaky-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39550, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1094, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:59:58.773156+00:00", "ended_at": "2026-08-26T14:00:05.756652+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b58655b-746d-41e9-9ca1-2136efa0f98d", "name": "polar-sullen-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40044, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 660, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:59:48.266938+00:00", "ended_at": "2026-08-26T13:59:54.001878+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "acb09280-b396-499c-8df8-a623268ec32b", "name": "sandy-jagged-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53744, "username": "ruslan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:59:43.689658+00:00", "ended_at": "2026-08-26T13:59:45.110991+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2171 }, { "id": "344f8572-d3ab-452b-afd8-10721b43fed8", "name": "freckled-tawny-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42358, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 696, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:59:38.328836+00:00", "ended_at": "2026-08-26T13:59:42.385505+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e22d17c-2cb6-4374-aed2-bce8aa2491da", "name": "rugged-frugal-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40674, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 645, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:59:25.763853+00:00", "ended_at": "2026-08-26T13:59:29.536375+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ee9ad9d-ec9a-4ba6-9a91-9a213d48597c", "name": "balmy-sincere-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53678, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 765, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:59:12.477519+00:00", "ended_at": "2026-08-26T13:59:17.880428+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "33133f18-e358-4bd9-a365-b9d4cfcb6316", "name": "candid-pristine-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38622, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:58:57.723250+00:00", "ended_at": "2026-08-26T13:59:03.577278+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5978697e-c67f-4590-bb6e-649156cbaf5d", "name": "rambling-stormy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50362, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 380, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:58:40.019436+00:00", "ended_at": "2026-08-26T13:58:45.526648+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6640c646-ed49-400a-bab8-114bdc117e9b", "name": "burly-quiet-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47496, "username": "devuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 402, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:58:39.867157+00:00", "ended_at": "2026-08-26T13:58:53.148917+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "9f4c30d4-563a-495a-9bb5-db8821aeb5a9", "name": "fleeting-quiet-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46944, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 382, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:58:23.899992+00:00", "ended_at": "2026-08-26T13:58:29.137292+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3e1d326-fd96-4dcc-a2d7-898de6c23d0e", "name": "frosty-meadow-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40510, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:58:08.535315+00:00", "ended_at": "2026-08-26T13:58:12.563344+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70a47b81-29fd-4cf0-afd5-77c5a5922328", "name": "kindly-polar-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40677, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:58:04.013595+00:00", "ended_at": "2026-08-26T13:58:05.224226+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2120 }, { "id": "a1a2024e-326c-48be-b112-73ebfdd29c55", "name": "fringed-serene-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33712, "username": "demo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 485, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:57:51.544305+00:00", "ended_at": "2026-08-26T13:58:00.724126+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "09687120-5c98-4b68-a6ae-27750ab1c027", "name": "muted-tawny-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35824, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:57:49.100229+00:00", "ended_at": "2026-08-26T13:57:53.910340+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "97d0f088-0d75-4a5c-857f-e2f1d644ec94", "name": "glassy-twilight-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 63832, "username": "faisal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:57:47.237455+00:00", "ended_at": "2026-08-26T13:57:48.592237+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2154 }, { "id": "2b2326dc-6a9b-4010-ae78-c681828b8156", "name": "blazing-vaulted-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52198, "username": "fred", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 381, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:57:41.270072+00:00", "ended_at": "2026-08-26T13:57:53.380854+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "9251107b-c43d-4a93-bff6-bb73f542edcc", "name": "feathered-bitter-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55064, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 644, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:57:14.609882+00:00", "ended_at": "2026-08-26T13:57:19.996733+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "68dbf231-62d3-42c3-8a64-0f0d80df4b26", "name": "austere-tranquil-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42194, "username": "osmc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:57:06.363093+00:00", "ended_at": "2026-08-26T13:57:18.043500+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "65af6007-dc60-4ed4-a2bd-8faf982dbbbb", "name": "mighty-plucky-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49778, "username": "elrond", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 634, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:56:56.030400+00:00", "ended_at": "2026-08-26T13:57:05.383664+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "050b8e2c-9edc-44b7-a927-0af0953ab4e9", "name": "smoky-glassy-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55020, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:56:33.214913+00:00", "ended_at": "2026-08-26T13:56:37.153352+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aceac43f-fa20-44c1-8b6f-f2c5ee3efeb0", "name": "steady-crimson-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49194, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:56:15.329661+00:00", "ended_at": "2026-08-26T13:56:21.037249+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac6df03a-2a99-40d6-8160-ed0c5d06c656", "name": "quiet-serene-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52180, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 486, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:56:05.734485+00:00", "ended_at": "2026-08-26T13:56:09.920374+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8260532-91ce-4ddd-9904-25649c0c7f2b", "name": "foggy-cheerful-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53802, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 499, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:55:57.980956+00:00", "ended_at": "2026-08-26T13:56:01.348730+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "91543665-4e0b-4800-a78c-c88a52baf5c4", "name": "upland-breezy-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60476, "username": "init", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 384, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:55:51.451506+00:00", "ended_at": "2026-08-26T13:56:01.713566+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "59302a61-2612-4208-880c-57bc9e169e91", "name": "windswept-airy-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56754, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:55:48.892489+00:00", "ended_at": "2026-08-26T13:55:50.492556+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "285b268d-8e88-4074-99b0-7601a3974d5a", "name": "reedy-mossy-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42462, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:55:30.988796+00:00", "ended_at": "2026-08-26T13:55:41.976648+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f090a379-d2d0-40f0-bef9-0e44b690685f", "name": "golden-restless-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40754, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:55:28.789041+00:00", "ended_at": "2026-08-26T13:55:34.767627+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c9d6f7ec-ae53-46c3-ae66-55da39cd2361", "name": "merry-noble-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40674, "username": "tu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:55:14.798951+00:00", "ended_at": "2026-08-26T13:55:16.062830+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "4d76f07c-0bbb-491a-9219-83bd8523d7bb", "name": "airy-chilly-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45786, "username": "reza", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 578, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:54:55.799961+00:00", "ended_at": "2026-08-26T13:55:04.479592+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "840b1257-6dce-4ed9-9a02-929803bbf4c7", "name": "ivory-sleepy-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49660, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 390, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:54:52.785324+00:00", "ended_at": "2026-08-26T13:54:56.599589+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "55fa7ec1-0486-4fdd-a0cd-e11e2b243c68", "name": "jolly-hushed-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49096, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:54:31.598692+00:00", "ended_at": "2026-08-26T13:54:37.909513+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad44b8f2-be6d-4783-b449-c007a3692db6", "name": "kindly-fearless-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37188, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:54:17.948351+00:00", "ended_at": "2026-08-26T13:54:20.745586+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7fc69e4f-e1e3-47c8-90b1-5a800b73f774", "name": "coastal-sullen-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53682, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 518, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:54:13.167014+00:00", "ended_at": "2026-08-26T13:54:18.819342+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd5e4e92-0ded-4306-9e2a-111e713d26ce", "name": "cunning-brisk-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46506, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 491, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:53:57.831090+00:00", "ended_at": "2026-08-26T13:54:00.613090+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "afed491f-443a-4678-b2db-1fd6102a464b", "name": "sandy-graceful-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52216, "username": "teamspeak", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:53:45.342766+00:00", "ended_at": "2026-08-26T13:53:46.697851+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2143 }, { "id": "46b27c3e-d106-4144-a0ce-3436f99e0571", "name": "orderly-weathered-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56464, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 417, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:53:44.441421+00:00", "ended_at": "2026-08-26T13:53:49.827770+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "94233871-d63e-4565-84e5-d94f9d5b247b", "name": "rapid-coastal-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33982, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:53:43.038029+00:00", "ended_at": "2026-08-26T13:53:47.080644+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "99ff4e51-66da-43a2-af85-8972f8c0b911", "name": "painted-lunar-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34232, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 354, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:53:17.353382+00:00", "ended_at": "2026-08-26T13:53:22.338450+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "24cb196f-6236-4f97-a8a5-6e8869e5caf8", "name": "quiet-frosty-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60812, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:53:05.484493+00:00", "ended_at": "2026-08-26T13:53:10.424998+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e90e78f6-ef2e-4728-b990-99874cbf5f21", "name": "muted-peaty-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35854, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 394, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:52:52.159305+00:00", "ended_at": "2026-08-26T13:52:56.708028+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bdcb82cb-51ee-4f41-b553-754622222ea6", "name": "sullen-shifting-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55124, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 514, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:52:40.198833+00:00", "ended_at": "2026-08-26T13:52:44.090745+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "215ced8a-5754-4c1e-aa4e-f93dfd2d660b", "name": "frugal-supple-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40609, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:52:26.025846+00:00", "ended_at": "2026-08-26T13:52:27.685370+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2109 }, { "id": "0703d6cd-6b1c-4625-b50a-b993cb6255c2", "name": "languid-feral-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51926, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:52:19.781087+00:00", "ended_at": "2026-08-26T13:52:22.699606+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf665f4c-f819-4672-b50f-7e19ede7167e", "name": "primal-umber-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51060, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:52:12.657737+00:00", "ended_at": "2026-08-26T13:52:17.029777+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "53907859-052c-40f0-90a1-8a4ac3c54253", "name": "candid-gentle-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54438, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 418, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:52:02.746173+00:00", "ended_at": "2026-08-26T13:52:05.937738+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef889a52-47c0-4eca-a6fb-3b00a74a1861", "name": "fickle-solemn-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35600, "username": "a", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 537, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:51:48.907119+00:00", "ended_at": "2026-08-26T13:51:52.189048+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1acaed3f-f46f-4bc5-bb50-d204692265c4", "name": "solemn-sandy-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53458, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:51:45.885664+00:00", "ended_at": "2026-08-26T13:51:47.363054+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2115 }, { "id": "c531c407-7e99-4a19-993d-d40963d05a78", "name": "curious-vivid-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35394, "username": "packer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:51:35.418009+00:00", "ended_at": "2026-08-26T13:51:48.159777+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "cd57bbfc-8cfd-4d8e-bf02-06f7a2c3956a", "name": "freckled-quiet-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40536, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:51:19.937272+00:00", "ended_at": "2026-08-26T13:51:26.146526+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "899c977d-2d7c-4b18-b62e-9b363067f70b", "name": "watchful-knotted-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34052, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 652, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:51:07.840639+00:00", "ended_at": "2026-08-26T13:51:11.207874+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "819bf7a3-afde-48d5-823b-e210b5fe3325", "name": "drifting-civil-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49600, "username": "nutanix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:51:07.580224+00:00", "ended_at": "2026-08-26T13:51:17.469617+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "31f65d3c-d9f2-42fe-be5c-457865a01835", "name": "dewy-cobalt-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57570, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 670, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:50:42.309388+00:00", "ended_at": "2026-08-26T13:50:45.716059+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7f30e6d-43aa-467d-bd7e-f93eca166e63", "name": "eager-scarlet-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47626, "username": "uploader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 651, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:50:31.951054+00:00", "ended_at": "2026-08-26T13:50:43.880215+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ab0884ed-70ed-4e44-9281-8cc7f2dfab83", "name": "coral-gloomy-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34094, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 474, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:50:14.045135+00:00", "ended_at": "2026-08-26T13:50:19.074443+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "50d501c0-7cb2-48cc-b8e4-6683c042d604", "name": "stoic-coral-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54878, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 709, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:50:06.150250+00:00", "ended_at": "2026-08-26T13:50:09.419632+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1451c410-02c8-4f27-8be8-f5a35e8dd8d3", "name": "frosty-fringed-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43940, "username": "aiuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:50:02.157545+00:00", "ended_at": "2026-08-26T13:50:14.994802+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6e24c3f8-99c5-4d18-b095-14b6b033502d", "name": "pleasant-tranquil-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60196, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:49:41.900181+00:00", "ended_at": "2026-08-26T13:49:43.221617+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "0af7d103-2e98-4bdb-876a-147ebe8b9ad0", "name": "honest-thrifty-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40606, "username": "promo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 753, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:49:39.315397+00:00", "ended_at": "2026-08-26T13:49:40.995564+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2085 }, { "id": "e3d7fc27-f60c-4692-9894-6a413fbdbe25", "name": "lofty-quartz-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37016, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 406, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:49:37.995054+00:00", "ended_at": "2026-08-26T13:49:42.000917+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "27957376-b113-4393-b5b5-a655e0bf295e", "name": "ginger-arctic-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52330, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 489, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:49:21.646119+00:00", "ended_at": "2026-08-26T13:49:26.313801+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6e3e8ab8-3f0e-4545-85b3-1b1841d28993", "name": "sturdy-primal-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57390, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 619, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:49:17.874212+00:00", "ended_at": "2026-08-26T13:49:21.032455+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "72a71825-a8b7-42f7-a352-ce148420377e", "name": "quartz-sleepy-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48618, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:48:55.062946+00:00", "ended_at": "2026-08-26T13:49:00.190339+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6086b688-1a2b-44b4-a24a-ae5d241b2fc6", "name": "glacial-painted-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44970, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:48:52.822122+00:00", "ended_at": "2026-08-26T13:48:58.237440+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4fc3d722-c47e-4e4e-994e-f8c4ff4c905a", "name": "languid-wooded-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37134, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:48:29.728075+00:00", "ended_at": "2026-08-26T13:48:34.449380+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8975d5a0-5120-48c9-82cd-d0b0e5b7cf72", "name": "diligent-watchful-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49720, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:48:16.381686+00:00", "ended_at": "2026-08-26T13:48:20.267617+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "112bc0c8-1b36-401d-b075-8bc138dd350a", "name": "solemn-knotted-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35256, "username": "amin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 670, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:48:09.457280+00:00", "ended_at": "2026-08-26T13:48:13.181789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3da272aa-5658-4472-8ec7-312731aed7f2", "name": "airy-craggy-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52348, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 565, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:47:53.425900+00:00", "ended_at": "2026-08-26T13:47:56.468717+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7a8cb551-33e6-41ca-aae1-021614cb34a5", "name": "kindly-fierce-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48822, "username": "hu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 505, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:47:48.681542+00:00", "ended_at": "2026-08-26T13:47:51.914274+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf5b002b-cfcb-4b2e-a989-9c3178182dda", "name": "dutiful-sullen-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 58848, "username": "yangx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:47:47.223333+00:00", "ended_at": "2026-08-26T13:47:49.210270+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2094 }, { "id": "b90bc680-2b58-4bdd-9c60-582a70df2d59", "name": "calm-gnarled-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44326, "username": "drcomadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 485, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:47:35.451165+00:00", "ended_at": "2026-08-26T13:47:48.365222+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "f7f7fbe6-bd40-4117-864e-a95e2115cbcc", "name": "meadow-forlorn-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51132, "username": "cursor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 509, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:47:32.767132+00:00", "ended_at": "2026-08-26T13:47:47.713626+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5249d50a-8841-470f-b4f4-32512b227392", "name": "gleaming-frank-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43228, "username": "sol", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:47:22.561224+00:00", "ended_at": "2026-08-26T13:47:32.192786+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "ab16ca17-a9d5-4c27-9a60-3452b2bdc134", "name": "sterling-stoic-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40603, "username": "sftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:46:55.311183+00:00", "ended_at": "2026-08-26T13:46:56.925106+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2069 }, { "id": "611ce416-a9d7-4353-b67c-3e4589581e8b", "name": "chilly-tangled-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40210, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 623, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:46:50.038043+00:00", "ended_at": "2026-08-26T13:46:53.278726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42747c61-2470-46f3-887f-24b4789f3c36", "name": "ancient-dutiful-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44534, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:46:42.328052+00:00", "ended_at": "2026-08-26T13:46:47.142433+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "149a062c-2ee8-4365-80a6-36ac1e97b31a", "name": "bronzed-salty-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56638, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 514, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:46:32.289025+00:00", "ended_at": "2026-08-26T13:46:35.865840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2cfede32-c8a5-4851-b53d-a3da86e9783c", "name": "orderly-grumpy-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57654, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 501, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:46:13.118144+00:00", "ended_at": "2026-08-26T13:46:17.331566+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07b65fe8-425e-4b9b-90a3-dce51fb369ef", "name": "lunar-restless-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55342, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 433, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:45:59.682989+00:00", "ended_at": "2026-08-26T13:46:05.837282+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cb7413ea-8ef5-458d-9ae3-1db2b223d063", "name": "early-blunt-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 54674, "username": "acer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:45:52.160935+00:00", "ended_at": "2026-08-26T13:45:53.165272+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2076 }, { "id": "108e615d-2368-4e6a-832c-8efc558c1fa3", "name": "murky-stormy-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49824, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:45:51.501849+00:00", "ended_at": "2026-08-26T13:46:02.205499+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "c52aaa41-8fe9-4486-9d31-63722580895e", "name": "lofty-dusty-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50518, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 627, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:45:24.157503+00:00", "ended_at": "2026-08-26T13:45:29.570756+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f1dd7895-02b3-4339-b925-ae8d8df5bda2", "name": "western-reedy-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36736, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 367, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:45:17.344104+00:00", "ended_at": "2026-08-26T13:45:23.651518+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8ec323c6-a000-4f62-a276-91fe059f81ca", "name": "supple-painted-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:45:02.405518+00:00", "ended_at": "2026-08-26T13:45:05.691780+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28d7e8f0-6ade-4a25-90f0-99bc462e97f1", "name": "zealous-lawful-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59582, "username": "test3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 397, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:44:57.048219+00:00", "ended_at": "2026-08-26T13:45:08.045440+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "7bab6054-eafd-4216-bf82-24d343e97b78", "name": "early-graceful-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38654, "username": "tempuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 789, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:44:43.250394+00:00", "ended_at": "2026-08-26T13:44:51.745877+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "90f77a26-cc4e-49ec-988a-631d10bd4c41", "name": "craggy-polar-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42384, "username": "core", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 505, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:44:18.002729+00:00", "ended_at": "2026-08-26T13:44:31.627474+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "3e305b63-27ff-4c22-adbc-2255c0eb3f4a", "name": "indigo-painted-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37164, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 482, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:44:17.982867+00:00", "ended_at": "2026-08-26T13:44:21.752196+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7174fda1-315e-4d85-be7e-621af5c57b3e", "name": "autumn-craggy-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51900, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 925, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:44:17.298460+00:00", "ended_at": "2026-08-26T13:44:18.623063+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "cd15fe3f-84ad-4f77-8459-173f84229507", "name": "merry-subtle-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40520, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 397, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:43:51.586149+00:00", "ended_at": "2026-08-26T13:43:56.266003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb8d8dff-caa8-4917-9730-2d891cdd4c01", "name": "gentle-proud-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47610, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 389, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:43:47.817254+00:00", "ended_at": "2026-08-26T13:43:53.599247+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "76a17a04-81fc-46e0-842e-f42baf2ed11f", "name": "opal-quaint-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40600, "username": "gpadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:43:47.076076+00:00", "ended_at": "2026-08-26T13:43:48.360001+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2067 }, { "id": "42543b63-fc4b-40b7-9a13-ec41d327ec93", "name": "fickle-rugged-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 59310, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:43:44.740814+00:00", "ended_at": "2026-08-26T13:43:46.271835+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "fe002db5-31c1-489b-8858-f75cc6ad9998", "name": "icy-supple-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56382, "username": "lin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 687, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:43:43.541685+00:00", "ended_at": "2026-08-26T13:43:54.724048+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "708ff0d4-c68c-4af3-ac57-f2b5230fc0c5", "name": "honest-daring-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46438, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 479, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:43:29.878090+00:00", "ended_at": "2026-08-26T13:43:40.242526+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "c6509a8d-b04c-4481-9ce1-4b3ace67c82f", "name": "vivid-crystal-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57172, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:43:01.086836+00:00", "ended_at": "2026-08-26T13:43:04.493309+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5cb160c7-2a72-45c7-b87d-1cee23d1db2c", "name": "proud-spirited-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38854, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:42:59.750133+00:00", "ended_at": "2026-08-26T13:43:05.889719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6dca6cf7-41bc-49a7-9189-df052f9dcbce", "name": "jovial-quiet-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35728, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:42:39.735038+00:00", "ended_at": "2026-08-26T13:42:45.621616+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1eb5d4fb-74e8-425b-905b-ad48485b24f5", "name": "smooth-lively-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51084, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 366, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:42:29.220025+00:00", "ended_at": "2026-08-26T13:42:34.589316+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c93a8bb9-63df-4b8b-ac91-227cadb0251c", "name": "dappled-forlorn-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33212, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:42:17.884163+00:00", "ended_at": "2026-08-26T13:42:22.688263+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ace463a-6631-461e-9ac5-9343e18b6a9d", "name": "chilly-sooty-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34690, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 633, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:41:58.509877+00:00", "ended_at": "2026-08-26T13:42:01.506611+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "39442dc8-58e1-4445-9fb1-c3bb5766a4a1", "name": "arctic-distant-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50178, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 581, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:41:46.161037+00:00", "ended_at": "2026-08-26T13:41:52.098249+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "163daaed-ce86-40b1-adca-4df6ae065541", "name": "indigo-wiry-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62784, "username": "postgres", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:41:43.909269+00:00", "ended_at": "2026-08-26T13:41:44.902723+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2086 }, { "id": "77c61bb5-fdb8-466b-8b5c-43a1590f8de5", "name": "wistful-flinty-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37626, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:41:32.482223+00:00", "ended_at": "2026-08-26T13:41:36.845087+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c53200e5-5cae-4ed8-8c7e-b05daed43c74", "name": "burly-regal-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59328, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 716, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:41:18.208467+00:00", "ended_at": "2026-08-26T13:41:23.461382+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b75b4f9b-239a-4419-9071-cf275ffca881", "name": "windswept-upland-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56988, "username": "botuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 668, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:41:08.963093+00:00", "ended_at": "2026-08-26T13:41:18.492519+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "cb3ba518-0c4e-4f70-9050-d020bad8cb20", "name": "russet-weathered-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40597, "username": "kim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:41:02.716304+00:00", "ended_at": "2026-08-26T13:41:03.522586+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2048 }, { "id": "858a0932-be08-43d0-afe3-adec50fe91cb", "name": "loyal-lucid-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51696, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 934, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:41:01.736509+00:00", "ended_at": "2026-08-26T13:41:03.499969+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "43e8c54f-7ad1-4e06-aeed-e7e1c81f1221", "name": "wistful-brisk-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45018, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:40:56.764135+00:00", "ended_at": "2026-08-26T13:41:02.549251+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f28b3e02-40dc-43d3-900b-8000f91ff42a", "name": "stormy-upland-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51288, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 618, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:40:40.251031+00:00", "ended_at": "2026-08-26T13:40:44.486046+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "56d1dda8-77de-4e70-b49a-793258a41342", "name": "sleepy-nameless-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58656, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 703, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:40:23.196144+00:00", "ended_at": "2026-08-26T13:40:37.311836+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6915dcbe-f477-4ce2-bea2-9dd874d6fe6b", "name": "verdant-marine-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45396, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 514, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:40:20.829920+00:00", "ended_at": "2026-08-26T13:40:26.004872+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10312c28-2549-418e-96fd-6c5e643a656f", "name": "thawing-muted-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54268, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:40:08.455748+00:00", "ended_at": "2026-08-26T13:40:18.763829+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4639407a-a989-4eef-b216-2c9d52afc280", "name": "grassy-austere-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46238, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 383, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:39:46.272192+00:00", "ended_at": "2026-08-26T13:39:51.229000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e4d6094e-7276-43a2-845a-328c4555f3bf", "name": "vigilant-amiable-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56164, "username": "pixel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:39:44.534056+00:00", "ended_at": "2026-08-26T13:39:45.132972+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2052 }, { "id": "74c0328f-8e7f-4362-8152-d05cd1328e7c", "name": "emerald-quiet-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49378, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 609, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:39:31.876628+00:00", "ended_at": "2026-08-26T13:39:37.440030+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ac92470-7b56-4e06-8d34-2719c402b5b7", "name": "glassy-sooty-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47942, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 361, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:39:23.093932+00:00", "ended_at": "2026-08-26T13:39:28.029634+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "75151ebd-b15d-48fb-9133-15da070611d5", "name": "mighty-blunt-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37232, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 501, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:39:08.743745+00:00", "ended_at": "2026-08-26T13:39:12.171637+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4c12d8f-201d-4053-97cf-94607f67f89c", "name": "gallant-ginger-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47612, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:38:56.880642+00:00", "ended_at": "2026-08-26T13:39:01.564047+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c5c3995a-a122-4f88-abe3-2292e676f710", "name": "lanky-canny-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33946, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 375, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:38:37.578161+00:00", "ended_at": "2026-08-26T13:38:41.312714+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d203dc85-1451-4507-9099-074a2fd4c9cd", "name": "fierce-plucky-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55968, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:38:32.605856+00:00", "ended_at": "2026-08-26T13:38:39.031220+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "18540208-2653-4b61-9092-7a1ce0734aea", "name": "valiant-frugal-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.55.45.217", "src_port": 54538, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 66, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:38:24.493888+00:00", "ended_at": "2026-08-26T13:38:25.078452+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "74a24ac0-729b-4828-babe-80ab14f90a50", "name": "cobalt-scarlet-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46584, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 504, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:38:17.275832+00:00", "ended_at": "2026-08-26T13:38:20.249953+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "24f52a97-f313-4ff1-aae7-7f248304a5d4", "name": "tangled-placid-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58296, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 637, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:38:09.795136+00:00", "ended_at": "2026-08-26T13:38:15.269703+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6ab027d5-570c-44cc-ba48-b115e3f0a633", "name": "gloomy-early-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40594, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:38:07.941746+00:00", "ended_at": "2026-08-26T13:38:08.705878+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2093 }, { "id": "170b3dff-f567-40ce-ba41-c58a5bc6f0f2", "name": "mighty-thorny-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34250, "username": "liyang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 501, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:38:00.013477+00:00", "ended_at": "2026-08-26T13:38:12.571768+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "09b9f7e9-442c-4620-b82d-79ed426f8809", "name": "whispering-mighty-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51506, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 930, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:37:48.623116+00:00", "ended_at": "2026-08-26T13:37:50.244066+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "27577029-5f0d-476a-bf4c-db3f715e9d8b", "name": "windswept-creaky-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41696, "username": "recorder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 583, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:37:47.212899+00:00", "ended_at": "2026-08-26T13:37:56.469584+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "2a30883d-7b95-49f9-91bd-66ddac1924e6", "name": "fierce-valiant-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52088, "username": "ajay", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:37:42.190540+00:00", "ended_at": "2026-08-26T13:37:42.793002+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "692c92ed-b0b0-43ba-937a-6eff77eb66bf", "name": "peaty-plucky-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41338, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 617, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:37:20.167723+00:00", "ended_at": "2026-08-26T13:37:25.091004+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fc6e756c-0a2c-4745-be3c-ac851d85b11b", "name": "peaty-lunar-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32986, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 412, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:37:15.858275+00:00", "ended_at": "2026-08-26T13:37:19.308823+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c393167e-70c5-4936-8004-f33366c3480b", "name": "mindful-freckled-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41452, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:37:14.744210+00:00", "ended_at": "2026-08-26T13:37:27.237382+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "683bbd50-f94d-4445-acb3-4c10862e20cb", "name": "muted-painted-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42476, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:36:53.976202+00:00", "ended_at": "2026-08-26T13:36:56.948416+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5e2089f-6c38-4cb2-9187-69fd3471595b", "name": "quiet-thrifty-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48578, "username": "fahmi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:36:48.423693+00:00", "ended_at": "2026-08-26T13:36:58.051627+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "054807cc-f414-40f7-920a-6afba8e81a02", "name": "earnest-hollow-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56314, "username": "doris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 429, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:36:34.556120+00:00", "ended_at": "2026-08-26T13:36:46.175471+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "3447fa55-b032-48e5-8c4e-16877de5804e", "name": "valiant-sleepy-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60874, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 733, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:36:08.960147+00:00", "ended_at": "2026-08-26T13:36:13.208656+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ed4c55e-6a39-4608-a235-8340cc8edd47", "name": "oaken-brazen-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39476, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 532, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:35:57.070017+00:00", "ended_at": "2026-08-26T13:36:01.387334+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1313fa92-7256-49ea-b253-919cb2597e76", "name": "austere-burly-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40534, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 408, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:35:48.185046+00:00", "ended_at": "2026-08-26T13:35:51.680674+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd8fe1c8-fffd-410e-9b58-22c89a555a37", "name": "marine-oaken-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33264, "username": "hduser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 482, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:35:32.850747+00:00", "ended_at": "2026-08-26T13:35:46.320410+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1876790d-862f-4cd2-b929-ae4e4ceea829", "name": "smoky-amber-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40724, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 478, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:35:29.539177+00:00", "ended_at": "2026-08-26T13:35:33.165397+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "54634a52-9cdd-4f29-bf5e-d942f0ce1301", "name": "fleeting-lucid-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44144, "username": "playground", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 630, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:35:14.311692+00:00", "ended_at": "2026-08-26T13:35:24.993288+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "eb74b5a3-a123-4986-a3bc-05afe8a9c66f", "name": "subtle-prickly-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54886, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 644, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:34:57.671797+00:00", "ended_at": "2026-08-26T13:35:01.342157+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5e266807-f308-4837-8727-adf13b3a0c6f", "name": "faded-salty-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51298, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 891, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:34:51.196430+00:00", "ended_at": "2026-08-26T13:34:52.702663+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "2496f8ca-7764-4140-905d-fccfbd7640ee", "name": "sterling-noble-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56380, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 518, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:34:44.786867+00:00", "ended_at": "2026-08-26T13:34:47.722309+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bba7e17-6f65-49f7-bf2b-4b51487533b4", "name": "craggy-cunning-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40054, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 511, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:34:29.403494+00:00", "ended_at": "2026-08-26T13:34:35.202458+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8f588832-e0ff-4c3b-81e9-ac8879a32133", "name": "tranquil-clever-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37998, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 468, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:34:11.518103+00:00", "ended_at": "2026-08-26T13:34:14.340356+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "83fd232f-08ac-4dfc-a0a6-adfd959ef8fb", "name": "crimson-gleaming-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55818, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 433, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:33:55.817882+00:00", "ended_at": "2026-08-26T13:34:01.655254+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3e0aa234-fb60-4ca1-b9e6-6be606cee2e8", "name": "smoky-glassy-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38224, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 494, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:33:49.961136+00:00", "ended_at": "2026-08-26T13:33:54.341728+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1b73a08f-f08b-48cf-b0da-6eefa72aca42", "name": "early-vigilant-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43042, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:33:35.888971+00:00", "ended_at": "2026-08-26T13:33:41.009682+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f952c270-bf36-494a-a044-2ac0b7f13dcf", "name": "brisk-bronzed-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35976, "username": "sdadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 505, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:33:21.676133+00:00", "ended_at": "2026-08-26T13:33:33.434665+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "410d5a3a-5c91-48c4-ad2c-fe463dc97fc3", "name": "flinty-bashful-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43260, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:33:19.433562+00:00", "ended_at": "2026-08-26T13:33:23.264096+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b4b90a5-935e-43c9-a379-8786a933038b", "name": "rapid-graceful-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "41.173.43.34", "src_port": 10000, "username": "cmsadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1316, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:32:59.279844+00:00", "ended_at": "2026-08-26T13:33:00.364442+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2078 }, { "id": "9c86f6bc-2da6-4e60-b91f-0da181a620b9", "name": "marine-feathered-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33534, "username": "rock", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 585, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:32:52.176008+00:00", "ended_at": "2026-08-26T13:32:55.989023+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "433b93e2-c095-4d86-be2b-096e607cb0ca", "name": "tranquil-steady-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45804, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:32:37.642060+00:00", "ended_at": "2026-08-26T13:32:41.103782+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ca91df6-5b60-472c-bd94-3649ddd7b3f0", "name": "sturdy-gloomy-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41444, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 493, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:32:31.716657+00:00", "ended_at": "2026-08-26T13:32:37.249634+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f3d18a4-fbf1-4448-907b-63eff591de40", "name": "tranquil-salty-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59292, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:32:24.221700+00:00", "ended_at": "2026-08-26T13:32:29.585623+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37809a6e-45ad-4baa-9baf-ddde6df2d9ab", "name": "dutiful-wiry-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35992, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 385, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:32:00.985642+00:00", "ended_at": "2026-08-26T13:32:07.531556+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3248d717-3fd0-465f-8193-0b9b2257996f", "name": "ruddy-blunt-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.233.213.67", "src_port": 38870, "username": "syncuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 726, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:31:50.657780+00:00", "ended_at": "2026-08-26T13:31:51.456511+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2040 }, { "id": "179185a1-81ca-4f69-be12-daf6a373331a", "name": "wooded-verdant-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42902, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 363, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:31:47.004629+00:00", "ended_at": "2026-08-26T13:31:53.051806+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6e449071-5714-41e6-897b-6909492a920f", "name": "wiry-mottled-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51100, "username": "valentina", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1200, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:31:42.417745+00:00", "ended_at": "2026-08-26T13:31:44.025795+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "23ecec89-aa24-405a-b181-4110860a4405", "name": "gloomy-sterling-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36418, "username": "almalinux", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 422, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:31:34.635657+00:00", "ended_at": "2026-08-26T13:31:49.682872+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "61b05b7b-f802-4cb9-a661-56167bdb35aa", "name": "idle-subtle-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41526, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 519, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:31:33.269991+00:00", "ended_at": "2026-08-26T13:31:37.303421+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03dc0126-d6b3-433e-be1b-ea68a512d37e", "name": "lonesome-rapid-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38654, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 471, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:31:00.549931+00:00", "ended_at": "2026-08-26T13:31:06.576525+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c238d805-0c45-4669-bb23-342741837bc4", "name": "jagged-genial-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51374, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 633, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:30:55.727875+00:00", "ended_at": "2026-08-26T13:30:59.487650+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2dc3831-3f8c-439b-b553-4eda60d513d7", "name": "orderly-burly-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32926, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:30:43.472830+00:00", "ended_at": "2026-08-26T13:30:47.094344+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "153a9b84-cef2-4e65-96db-334c453c0399", "name": "wooded-lonesome-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44452, "username": "ranga", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:30:42.508748+00:00", "ended_at": "2026-08-26T13:30:53.212717+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "8824bff8-4f9b-46f9-8acd-e579466454a5", "name": "dusky-creaky-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35346, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:30:16.477911+00:00", "ended_at": "2026-08-26T13:30:21.988035+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cdf0c5c0-d027-404d-84f5-211cf418a0e0", "name": "whispering-downy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46754, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 691, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:30:07.590520+00:00", "ended_at": "2026-08-26T13:30:11.904841+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e33fb34c-e844-46fc-b3db-d3f9497a6bd9", "name": "calm-earnest-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59482, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 651, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:29:52.014376+00:00", "ended_at": "2026-08-26T13:29:55.117603+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d72fe3d-a691-4779-950e-a6099d198d31", "name": "tranquil-painted-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54342, "username": "manoj", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 554, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:29:41.045477+00:00", "ended_at": "2026-08-26T13:29:55.549727+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "f95928bb-e1a1-4806-8285-d1ae3d7c879b", "name": "restless-crisp-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50448, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:29:38.649274+00:00", "ended_at": "2026-08-26T13:29:44.080901+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fe121eba-714e-4a34-8a1d-f65aa914ac2b", "name": "blithe-sleepy-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39938, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:29:16.915689+00:00", "ended_at": "2026-08-26T13:29:21.667151+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2a710583-82b8-4888-8229-9a6ad110cb37", "name": "inland-murky-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39790, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:29:02.093839+00:00", "ended_at": "2026-08-26T13:29:07.248402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c69b7de-2ce9-4d43-b4e8-128ee6683023", "name": "prickly-spirited-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46482, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 520, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:28:52.588903+00:00", "ended_at": "2026-08-26T13:28:56.894368+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f82ac3fc-206a-42a7-9746-bad253c1b16e", "name": "murky-fierce-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43536, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 834, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:28:38.788014+00:00", "ended_at": "2026-08-26T13:28:41.734993+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95155622-c7c1-4e5c-b72b-63fc2e9c2971", "name": "forlorn-hardy-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38084, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 825, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:28:34.240756+00:00", "ended_at": "2026-08-26T13:28:39.693621+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "18e61d27-ebe7-4c71-8696-b24a854aad5b", "name": "gallant-faded-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50902, "username": "zzl", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1207, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:28:25.500665+00:00", "ended_at": "2026-08-26T13:28:26.300194+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "9c073c60-b8b0-4db8-80d3-cddc0c3e6a49", "name": "ruddy-serene-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60474, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 664, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:28:19.439583+00:00", "ended_at": "2026-08-26T13:28:23.596497+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "150f70ee-07a2-4f5b-a18a-86518bc45cca", "name": "jolly-pleasant-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52104, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 659, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:28:05.686385+00:00", "ended_at": "2026-08-26T13:28:09.742321+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d87e8d53-1936-43a5-932c-b504958a2f76", "name": "rapid-sturdy-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33940, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:27:39.730360+00:00", "ended_at": "2026-08-26T13:27:45.563252+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f5810a1-4c36-4d98-b38f-37244620eead", "name": "sincere-lonesome-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53834, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 599, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:27:33.724269+00:00", "ended_at": "2026-08-26T13:27:38.020119+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a50c325d-ddeb-4bac-be2c-04331acda6f1", "name": "supple-mottled-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 494, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:27:19.453364+00:00", "ended_at": "2026-08-26T13:27:24.514699+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a9e5907-b083-4677-9360-f1714958b5f8", "name": "woven-obsidian-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60636, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 668, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:27:04.560390+00:00", "ended_at": "2026-08-26T13:27:10.304018+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f109b24a-f319-4066-8841-e50043e2dc9d", "name": "hearty-silent-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43098, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:26:59.639925+00:00", "ended_at": "2026-08-26T13:27:05.628807+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dbfa33e2-54d0-4362-8967-bd8bddb3903a", "name": "fringed-spirited-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60094, "username": "system", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 710, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:26:50.085899+00:00", "ended_at": "2026-08-26T13:27:00.116890+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7314249d-e0da-4192-9c20-59dbb85fd07a", "name": "deft-fleeting-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40406, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 635, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:26:23.222443+00:00", "ended_at": "2026-08-26T13:26:28.259049+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "caf5f80b-2269-42be-9116-24c9a5333b7b", "name": "keen-lucid-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35244, "username": "bot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 622, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:26:18.742464+00:00", "ended_at": "2026-08-26T13:26:33.069008+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "d03363a3-01f9-4b45-b427-8012e1a1ca2f", "name": "crisp-ginger-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56104, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 631, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:26:01.695413+00:00", "ended_at": "2026-08-26T13:26:05.290100+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4fbb1d72-134c-4a1e-a868-c07ae5e15b8f", "name": "misty-whispering-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41486, "username": "labuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 468, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:25:49.202140+00:00", "ended_at": "2026-08-26T13:26:05.830897+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "68604649-1c11-4bcf-922d-75b3b3fe6d5f", "name": "daring-ruddy-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47538, "username": "localhost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:25:49.151280+00:00", "ended_at": "2026-08-26T13:26:05.973805+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "cf83889e-0918-4ba1-b0e8-d882471077d0", "name": "flinty-patient-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48062, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:25:24.282949+00:00", "ended_at": "2026-08-26T13:25:28.106615+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34448d6f-7d6f-4e0a-a748-db6eb8c3621f", "name": "boreal-blithe-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34468, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:25:05.507150+00:00", "ended_at": "2026-08-26T13:25:11.874469+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "282f8780-7747-4c48-ba6b-d54eae7a8928", "name": "creaky-bitter-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39950, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 521, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:25:02.827560+00:00", "ended_at": "2026-08-26T13:25:14.764618+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b7b8b4b7-c648-474c-8e39-b326ca5a3f05", "name": "frank-prickly-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42846, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 543, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:24:37.620440+00:00", "ended_at": "2026-08-26T13:24:42.277406+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9dc232c-a718-4fb0-97e5-fc8022fb2336", "name": "dapper-wry-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37882, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:24:27.141343+00:00", "ended_at": "2026-08-26T13:24:31.742249+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d67fe4a8-e40c-4821-b4c1-4e8757459db4", "name": "sterling-primal-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36038, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 555, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:24:12.761287+00:00", "ended_at": "2026-08-26T13:24:17.807530+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a384604-88c8-4d33-93fc-72f2280f81fb", "name": "stoic-ivory-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52954, "username": "main", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 859, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:24:12.575764+00:00", "ended_at": "2026-08-26T13:24:22.266279+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "9ba8a6f7-afe8-4d30-a64d-bc9131858797", "name": "faded-distant-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59014, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 653, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:23:47.425754+00:00", "ended_at": "2026-08-26T13:23:51.150350+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "364c94ec-c9d2-45f0-b8e4-2427a4f1f560", "name": "peaty-steady-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50074, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 496, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:23:30.933953+00:00", "ended_at": "2026-08-26T13:23:35.553378+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a399e888-5e4b-4246-826b-eafc879e796e", "name": "thrifty-distant-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54386, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 613, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:23:21.784541+00:00", "ended_at": "2026-08-26T13:23:27.905262+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d612b5f-2bf6-41af-8d68-2d5075267b5f", "name": "keen-languid-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55896, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 588, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:23:05.753381+00:00", "ended_at": "2026-08-26T13:23:10.237620+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "af2948d0-6a2d-463f-81d7-e55ced154362", "name": "languid-gentle-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54420, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:22:58.242225+00:00", "ended_at": "2026-08-26T13:23:03.857888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78e4645f-d6d9-4fb6-9a97-b08c766e5bd3", "name": "tidal-eager-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35106, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 704, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:22:40.376519+00:00", "ended_at": "2026-08-26T13:22:44.669859+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "96065b3c-0d4c-49e3-a062-46802a352d6e", "name": "solemn-cheerful-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34532, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 677, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:22:39.465462+00:00", "ended_at": "2026-08-26T13:22:51.253147+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "a3e225e5-b663-4535-a7e2-60a26f15885f", "name": "ashen-frugal-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41676, "username": "vyos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 657, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:22:34.403034+00:00", "ended_at": "2026-08-26T13:22:43.743187+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "c761b5d2-5814-4461-871c-d1975cead17a", "name": "marbled-verdant-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57244, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 701, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:22:08.751546+00:00", "ended_at": "2026-08-26T13:22:13.175615+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e5d76c0f-8c65-4ed9-b4cb-984914c0b434", "name": "flinty-kindly-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56358, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 660, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:21:59.045505+00:00", "ended_at": "2026-08-26T13:22:04.788413+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da994aa2-008d-4b69-b05f-7ceeb86a64fa", "name": "chilly-deft-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "125.142.37.91", "src_port": 46416, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 632, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:21:48.264018+00:00", "ended_at": "2026-08-26T13:21:49.062135+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2093 }, { "id": "9341314a-c666-428a-ad30-b5e08049bc6c", "name": "wry-tender-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50494, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1209, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:21:47.359998+00:00", "ended_at": "2026-08-26T13:21:48.920783+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "906cfede-1e13-495b-ab72-2504fbf2927a", "name": "twilight-dappled-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40854, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:21:32.164849+00:00", "ended_at": "2026-08-26T13:21:38.897566+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "08e9f6b7-b38d-482e-9a74-3741d4bb231c", "name": "fearless-zealous-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50612, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:21:16.930209+00:00", "ended_at": "2026-08-26T13:21:20.655248+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8bb680ce-5250-4454-8702-fcd91992be3c", "name": "frank-solar-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55832, "username": "kipt", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 532, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:21:10.782283+00:00", "ended_at": "2026-08-26T13:21:19.920584+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2f3a23a8-0e01-4580-8622-9b67b449a9f1", "name": "oaken-quaint-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42780, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:21:04.389418+00:00", "ended_at": "2026-08-26T13:21:07.703292+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c8c40091-acfe-4896-a2d9-297687dcaa2e", "name": "western-early-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40930, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 649, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:20:45.221954+00:00", "ended_at": "2026-08-26T13:20:50.029641+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2bb8b7ca-29ce-4e8c-a1e5-be6735c03e7b", "name": "spirited-wooded-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56386, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 474, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:20:29.017650+00:00", "ended_at": "2026-08-26T13:20:35.245681+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "074d4433-8b22-4d18-af6f-822e9ff9b30d", "name": "hazel-jovial-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39622, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:20:18.984510+00:00", "ended_at": "2026-08-26T13:20:23.807623+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "937d29e4-9b51-4ef3-81b1-25949ccd39f2", "name": "frosty-rugged-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48778, "username": "csgo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 413, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:20:13.531496+00:00", "ended_at": "2026-08-26T13:20:20.964108+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "54c7d7ac-fb63-4615-b089-6a2c1a73ac1c", "name": "reedy-cosmic-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54064, "username": "arthur", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 490, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:20:02.631121+00:00", "ended_at": "2026-08-26T13:20:13.445010+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e9c22aab-a3b6-4ea0-ba0d-f550ad366c9f", "name": "vaulted-northern-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57128, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 533, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:19:39.665578+00:00", "ended_at": "2026-08-26T13:19:42.854492+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a36799c0-6f8d-459b-9004-35a7432f4ea4", "name": "seaward-watchful-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43498, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:19:24.374581+00:00", "ended_at": "2026-08-26T13:19:35.399389+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "c58f753f-71cb-41b6-b807-c0c29666760d", "name": "gnarled-orderly-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43710, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:19:22.700808+00:00", "ended_at": "2026-08-26T13:19:26.209549+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7a3b2e58-1424-44bf-ac9a-35e0b73dd2af", "name": "keen-calm-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34334, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 433, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:18:58.661415+00:00", "ended_at": "2026-08-26T13:19:03.711401+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86fca611-5d5b-4a78-b15f-39b46a687c6f", "name": "hearty-lofty-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57404, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:18:50.675410+00:00", "ended_at": "2026-08-26T13:18:54.266334+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d7151da-f230-43bc-9082-4e63f36af82d", "name": "nimble-silent-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58792, "username": "clawdbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:18:40.374157+00:00", "ended_at": "2026-08-26T13:18:51.032066+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "1261f400-7a1d-4efd-b2a7-d9feaf63e031", "name": "autumn-cobalt-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50286, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 951, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:18:24.164394+00:00", "ended_at": "2026-08-26T13:18:26.224187+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "b7f50573-baa2-4879-8a12-fed6dc9742b9", "name": "merry-plucky-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32802, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 681, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:18:20.171924+00:00", "ended_at": "2026-08-26T13:18:26.209824+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8169a100-759c-4a0d-b015-05dfb35ab9b0", "name": "leafy-mighty-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34454, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 864, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:18:12.873037+00:00", "ended_at": "2026-08-26T13:18:17.279162+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f356088-01cc-44fa-bc56-0d1c5cb06ac8", "name": "dewy-reedy-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32920, "username": "erpnext", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 790, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:18:10.823137+00:00", "ended_at": "2026-08-26T13:18:21.490337+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "a0c725b6-9614-4c40-b897-42d11a5688c4", "name": "mossy-amber-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33968, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 900, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:17:47.763425+00:00", "ended_at": "2026-08-26T13:17:58.293368+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "5c5dc15d-1289-485b-827d-fab2724e2de0", "name": "rapid-seaward-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60972, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 845, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:17:32.257467+00:00", "ended_at": "2026-08-26T13:17:35.337924+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5528b84-0fc4-4645-8bbe-443b796c187a", "name": "obsidian-blazing-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41378, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 581, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:17:17.839192+00:00", "ended_at": "2026-08-26T13:17:22.165000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "26c1f9be-faaa-41ce-b730-9a4a101cd086", "name": "quaint-knotted-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57736, "username": "config", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 619, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:17:17.766810+00:00", "ended_at": "2026-08-26T13:17:31.816720+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9e844139-95cd-4f43-8069-631dd70d7943", "name": "dewy-vernal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49090, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 653, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:16:45.519391+00:00", "ended_at": "2026-08-26T13:16:58.577340+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3288cc6c-8f3d-45ea-b410-7b3eb0efcad2", "name": "misty-drifting-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 427, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:16:45.413046+00:00", "ended_at": "2026-08-26T13:16:48.737378+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "25beb220-389a-4dd7-a5a0-a64eaed20f0f", "name": "austere-gleaming-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45136, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 417, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:16:16.188049+00:00", "ended_at": "2026-08-26T13:16:21.006775+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "46afc84b-b02f-4a84-ba29-25d0e3fe2deb", "name": "shifting-bitter-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46326, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 467, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:16:10.082418+00:00", "ended_at": "2026-08-26T13:16:16.202869+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8c713a3-9060-4183-b4c8-fa0d898b8ef7", "name": "sunlit-tidal-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58122, "username": "marcu1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:15:59.818574+00:00", "ended_at": "2026-08-26T13:16:11.641436+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2fdf90d1-e6fe-40c2-8e80-2369762a947f", "name": "gleaming-feral-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41944, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:15:42.787528+00:00", "ended_at": "2026-08-26T13:15:46.581596+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07ce5ea8-7603-4889-80b0-b7d94eadd9b7", "name": "sincere-hollow-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48408, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 479, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:15:33.236750+00:00", "ended_at": "2026-08-26T13:15:38.702447+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d267a83-325a-4bde-a61c-5c4373b32e81", "name": "obsidian-tidal-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38322, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:15:18.877498+00:00", "ended_at": "2026-08-26T13:15:23.563787+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c010eb6f-55ef-47a1-8e86-7c91519a9acd", "name": "diligent-smoky-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33708, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 576, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:15:10.226622+00:00", "ended_at": "2026-08-26T13:15:13.985879+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "00394236-bcb6-4a9b-af1f-1c221f8e2a22", "name": "faded-muted-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50090, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1167, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:15:06.296677+00:00", "ended_at": "2026-08-26T13:15:08.206951+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0c0ef5d1-1bde-4823-8f14-724e9f9a1d51", "name": "windswept-ancient-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50542, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 863, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:14:51.662641+00:00", "ended_at": "2026-08-26T13:14:54.777003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41220127-00e0-4529-b8a6-99163cbec477", "name": "stoic-salty-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36008, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:14:39.354762+00:00", "ended_at": "2026-08-26T13:14:42.913351+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3af850ff-071b-451e-a415-8181f21c3410", "name": "thrifty-somber-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56898, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 629, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:14:33.206956+00:00", "ended_at": "2026-08-26T13:14:38.367060+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70256eb5-c92d-4d24-94d9-b582587fa884", "name": "twilight-crimson-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40600, "username": "ali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 491, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:14:27.066663+00:00", "ended_at": "2026-08-26T13:14:43.470876+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "0bcce3a1-43cd-4c3b-a0a4-e5f3f2d368d5", "name": "autumn-ancient-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57040, "username": "centreon", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:14:06.682592+00:00", "ended_at": "2026-08-26T13:14:16.877122+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "505946af-7971-49af-a6e7-8500159ae66b", "name": "dewy-breezy-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50376, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 436, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:13:41.940147+00:00", "ended_at": "2026-08-26T13:13:45.720383+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4543eaaf-d613-4926-ae68-9868f27bba86", "name": "pleasant-jagged-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48610, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:13:41.212109+00:00", "ended_at": "2026-08-26T13:13:44.034850+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e631f14a-d738-4030-930d-42aa0d99eaa3", "name": "dutiful-inland-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46672, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:13:24.306713+00:00", "ended_at": "2026-08-26T13:13:30.132328+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b371ba3-ea3b-4da8-a668-f14ad5935944", "name": "prairie-idle-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47846, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:13:12.288842+00:00", "ended_at": "2026-08-26T13:13:15.335955+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "125572b4-faa6-4a9a-91e8-ea68ecc31bb7", "name": "peaty-lanky-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47422, "username": "gg", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:13:08.147218+00:00", "ended_at": "2026-08-26T13:13:16.120255+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "63f9f027-c70b-47d0-ad78-f5092e973113", "name": "brave-hollow-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42270, "username": "Caps", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 684, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:12:53.925774+00:00", "ended_at": "2026-08-26T13:13:06.190416+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "88dd2059-7d1a-48ad-b90c-a637db8f1886", "name": "marine-mighty-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37304, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:12:28.131609+00:00", "ended_at": "2026-08-26T13:12:34.319861+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9e678ca-0233-46d6-8a1b-a42a9a4e8992", "name": "obsidian-tawny-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34450, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:12:18.096314+00:00", "ended_at": "2026-08-26T13:12:22.557221+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f478697-0697-4c09-96f0-bb92d24d88ce", "name": "fleeting-whispering-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60870, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 553, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:12:05.090701+00:00", "ended_at": "2026-08-26T13:12:09.539132+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "87729ee9-39fb-4102-85e1-e2d6897e61bc", "name": "gleaming-primal-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56078, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 389, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:11:53.528453+00:00", "ended_at": "2026-08-26T13:11:57.453270+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "08b1ed45-b4fb-4c63-9613-aaea3cbca3b7", "name": "murky-wandering-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 49888, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1202, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:11:42.028828+00:00", "ended_at": "2026-08-26T13:11:47.309219+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "06123f16-d6b7-4e3c-8183-957dabd4ab2a", "name": "hazy-quiet-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39124, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 496, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:11:35.867024+00:00", "ended_at": "2026-08-26T13:11:41.620641+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e826d04e-6034-4bf0-a01b-5f4a48eb1f9f", "name": "sunlit-orderly-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39342, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:11:22.978700+00:00", "ended_at": "2026-08-26T13:11:28.777179+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5684cadd-2bc0-46b0-87b4-9d98b4aa9331", "name": "feathered-crisp-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43866, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:11:05.396774+00:00", "ended_at": "2026-08-26T13:11:11.407121+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9956f98a-eeaf-4103-859c-97a2785ede26", "name": "sleepy-granite-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57634, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:10:55.096582+00:00", "ended_at": "2026-08-26T13:11:00.730089+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2422be0-4caf-4b0f-bc4a-579c5d12d653", "name": "languid-somber-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56454, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:10:42.467462+00:00", "ended_at": "2026-08-26T13:10:47.866137+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e399e408-16e5-44c7-bea8-aa07e0c27a28", "name": "ginger-silent-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49616, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 433, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:10:36.721570+00:00", "ended_at": "2026-08-26T13:10:46.790122+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "54fdf170-4b5a-45b1-9c78-62cc080d738b", "name": "chilly-tranquil-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36112, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 405, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:10:18.920256+00:00", "ended_at": "2026-08-26T13:10:23.882807+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1ad50f25-28bc-4f14-869f-ce6a116bd9e3", "name": "plucky-arctic-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54718, "username": "default", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 399, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:10:02.820942+00:00", "ended_at": "2026-08-26T13:10:12.515844+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "267e7f2a-494d-415c-b91c-10359839d460", "name": "dapper-valiant-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43916, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:10:00.972644+00:00", "ended_at": "2026-08-26T13:10:04.906099+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2c44b347-99b6-4cba-a534-0facd8e9005c", "name": "crystal-velvet-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39786, "username": "agent", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:09:49.730809+00:00", "ended_at": "2026-08-26T13:10:01.806037+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "6cadba27-1071-4d06-8d16-2276c8de212d", "name": "polar-gilded-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48070, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 533, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:09:28.326420+00:00", "ended_at": "2026-08-26T13:09:32.873666+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "283f1b4b-05ed-4918-bd5e-3892baddb4d4", "name": "boreal-ivory-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47094, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 489, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:09:20.131624+00:00", "ended_at": "2026-08-26T13:09:24.978420+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "00df6462-da6a-452e-abf4-5663c42eb5b8", "name": "wry-patient-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35988, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 388, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:09:07.948095+00:00", "ended_at": "2026-08-26T13:09:12.127433+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "585e4bf6-c585-4650-a7c2-9c0ce44f1d11", "name": "clever-proud-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37894, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 436, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:08:56.434707+00:00", "ended_at": "2026-08-26T13:09:00.539823+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4d000fa-af0f-4ad8-830c-93b748035c65", "name": "hardy-supple-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37028, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 598, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:08:37.117541+00:00", "ended_at": "2026-08-26T13:08:41.995865+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "38df8a4e-f332-4892-a793-66dae3d31645", "name": "shaded-sincere-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 49686, "username": "student", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 922, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:08:30.023318+00:00", "ended_at": "2026-08-26T13:08:31.647250+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "c9887d24-93d1-4e56-9b6d-48149df9467d", "name": "ginger-prickly-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47108, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 710, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:08:26.244070+00:00", "ended_at": "2026-08-26T13:08:30.287826+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c343ddd-fef3-4619-9878-3360feb1940b", "name": "bronzed-hushed-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56562, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 482, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:08:15.392708+00:00", "ended_at": "2026-08-26T13:08:19.565474+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30a5c6eb-4c3b-4b10-920d-38c66dd9da98", "name": "gallant-reedy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44004, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:08:02.073755+00:00", "ended_at": "2026-08-26T13:08:07.230428+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9c5ace5-3650-488f-addb-c47fb4d38ed4", "name": "fabled-craggy-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43600, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:07:47.231399+00:00", "ended_at": "2026-08-26T13:07:50.366584+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e9317fc9-a123-44bd-a9a0-84390c407770", "name": "deft-vernal-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36742, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 429, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:07:24.920367+00:00", "ended_at": "2026-08-26T13:07:28.510810+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2a82abe8-70c2-4c34-bcbe-70fe4abfc621", "name": "seaward-vaulted-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46512, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 466, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:07:19.028597+00:00", "ended_at": "2026-08-26T13:07:21.754113+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cb939376-d183-493b-8179-169966064506", "name": "crimson-drifting-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59062, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 382, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:07:03.250530+00:00", "ended_at": "2026-08-26T13:07:08.890012+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2955a9ca-9f9f-4ad1-be9b-2b26d27fdb9f", "name": "gritty-curious-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59024, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 475, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:06:59.159552+00:00", "ended_at": "2026-08-26T13:07:09.199026+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "699b5ba3-a1dc-44d2-8725-7274058f1cd8", "name": "wistful-airy-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42176, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:06:33.377642+00:00", "ended_at": "2026-08-26T13:06:38.401369+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db7cbb08-bbd5-4234-a1aa-6b28c518b103", "name": "lofty-nimble-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58896, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 420, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:06:22.576133+00:00", "ended_at": "2026-08-26T13:06:28.082888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf15a45f-7bf5-4ed2-8c73-913244291c87", "name": "fleeting-fearless-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56030, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 500, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:06:14.699215+00:00", "ended_at": "2026-08-26T13:06:19.261850+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d2e853f-9601-45fd-88c7-50e0185449b5", "name": "diligent-brisk-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58080, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 425, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:05:59.105503+00:00", "ended_at": "2026-08-26T13:06:02.506815+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5e9af4b1-6680-4af0-987d-d501bddd358c", "name": "restless-languid-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53990, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:05:45.420671+00:00", "ended_at": "2026-08-26T13:05:50.597065+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e4017d32-77a2-44b2-97fd-df3742c4c66e", "name": "mossy-hushed-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40132, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 392, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:05:31.414558+00:00", "ended_at": "2026-08-26T13:05:37.478104+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "63b7fd2c-8332-42a5-9ab7-b62c08f668b3", "name": "supple-painted-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44104, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 499, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:05:23.453326+00:00", "ended_at": "2026-08-26T13:05:26.258138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9984a96a-220a-40e1-b891-4b866755ad3f", "name": "muted-clever-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40758, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:05:12.424812+00:00", "ended_at": "2026-08-26T13:05:17.009675+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6c7701fb-a197-4086-b723-cd225bf6f9b4", "name": "lawful-crisp-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44142, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 411, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:04:55.844694+00:00", "ended_at": "2026-08-26T13:05:01.436182+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "65e48b72-2f66-4b8a-ae87-d2bc33a985aa", "name": "earnest-hearty-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 485, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:04:43.959301+00:00", "ended_at": "2026-08-26T13:04:46.688241+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "937fd496-8b8d-4d18-9d76-51ef1e424527", "name": "feathered-wiry-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36916, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 406, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:04:33.320826+00:00", "ended_at": "2026-08-26T13:04:42.816370+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4e755372-ab01-4770-8324-a8731864bf2f", "name": "prairie-indigo-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33138, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 498, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:04:12.487234+00:00", "ended_at": "2026-08-26T13:04:16.852233+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d40f5bc3-1892-481a-8d45-dffa6dc0de65", "name": "slender-brisk-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45462, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 760, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:04:00.585731+00:00", "ended_at": "2026-08-26T13:04:06.542460+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8f2517a8-9b81-4627-a2b1-25e12ce9fbb1", "name": "curious-hushed-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52070, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 475, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:03:49.409514+00:00", "ended_at": "2026-08-26T13:03:55.064198+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f05870be-e948-4f35-9845-7056f21e5861", "name": "marbled-whispering-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 728, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:03:36.544608+00:00", "ended_at": "2026-08-26T13:03:39.753382+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a4849071-32f5-435c-86f8-e22071497d75", "name": "patient-supple-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42252, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:03:35.326813+00:00", "ended_at": "2026-08-26T13:03:50.301692+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d8f0e57d-3609-4de6-9827-c7e242da590a", "name": "vernal-somber-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48412, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:03:08.287276+00:00", "ended_at": "2026-08-26T13:03:12.854280+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1122d674-988f-4327-946b-18e43ace3177", "name": "genial-sandy-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58624, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 395, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:02:52.815945+00:00", "ended_at": "2026-08-26T13:02:57.921398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "293757c4-5e8d-4346-8217-dc02dcbffbff", "name": "stormy-flinty-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35480, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 539, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:02:41.676587+00:00", "ended_at": "2026-08-26T13:02:47.041043+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d29f29d8-275c-4952-b9e7-1e22a15c582e", "name": "candid-grassy-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45808, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:02:24.039645+00:00", "ended_at": "2026-08-26T13:02:27.602003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2fec5b3a-920a-4b11-8701-03e528823c24", "name": "rugged-languid-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60708, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 545, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:02:11.644728+00:00", "ended_at": "2026-08-26T13:02:16.221349+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01b8a734-3a39-4bce-bc22-9b580a4c5140", "name": "diligent-deft-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52278, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 584, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:02:00.588297+00:00", "ended_at": "2026-08-26T13:02:03.403056+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34631e90-210c-4ee9-b12a-f652f76efbf7", "name": "velvet-distant-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45010, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:01:52.220137+00:00", "ended_at": "2026-08-26T13:01:58.365176+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9bdbf05b-31f2-49de-8861-c89fed1ec625", "name": "prairie-weathered-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33254, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:01:33.497459+00:00", "ended_at": "2026-08-26T13:01:36.590962+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6cdf4cde-d6f0-488c-899a-8ec01dd233ab", "name": "spirited-gritty-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35904, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 632, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:01:20.957737+00:00", "ended_at": "2026-08-26T13:01:23.849729+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4ad7d75-21da-44ea-9187-ebe2a3b31931", "name": "solar-reedy-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47410, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 468, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:01:13.193016+00:00", "ended_at": "2026-08-26T13:01:18.716739+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f907c85-c3a1-495f-9d5d-243ae3465460", "name": "mottled-sooty-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41720, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 429, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:00:57.146459+00:00", "ended_at": "2026-08-26T13:01:02.990032+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "df2df546-2caa-4d78-99f7-6e2a89946cb3", "name": "silent-distant-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39664, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 625, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:00:43.800764+00:00", "ended_at": "2026-08-26T13:00:49.066384+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ec51c693-298e-48b2-96e4-a6ef273e7082", "name": "wiry-brisk-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60690, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 595, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:00:28.600251+00:00", "ended_at": "2026-08-26T13:00:34.854002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7518527c-896a-4cc7-80fa-fe707fcbd50e", "name": "ginger-clever-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33746, "username": "amine", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:00:24.750074+00:00", "ended_at": "2026-08-26T13:00:37.108778+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "0237adba-8006-4803-ae6c-6f3be4d08987", "name": "lunar-sullen-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35700, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T13:00:06.462888+00:00", "ended_at": "2026-08-26T13:00:10.211650+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "647c52c5-9b13-4de4-a5e0-e5722440c318", "name": "sooty-craggy-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39628, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 466, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:59:50.000331+00:00", "ended_at": "2026-08-26T12:59:55.318674+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "71a53a8c-b9e0-4df7-8842-e952c47580e9", "name": "graceful-salty-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36608, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:59:34.489086+00:00", "ended_at": "2026-08-26T12:59:38.139659+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cc6a2bb2-e48a-4681-962e-68af2389e1df", "name": "humble-upland-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40682, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 568, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:59:26.181398+00:00", "ended_at": "2026-08-26T12:59:38.167672+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "c4001c4a-2129-414a-9db4-36677973a1a1", "name": "drifting-cosmic-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 49088, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 934, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:59:15.601396+00:00", "ended_at": "2026-08-26T12:59:17.012599+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "211683c5-ca3b-46d2-ba0f-96b52d501c7e", "name": "oaken-mindful-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60430, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:59:07.713884+00:00", "ended_at": "2026-08-26T12:59:12.511927+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "175bf7c8-c2bd-48a4-a810-e8d73481e69b", "name": "coral-sullen-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44396, "username": "angel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:58:56.800072+00:00", "ended_at": "2026-08-26T12:59:06.478506+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b15dbd0f-7260-4fbb-88dc-85a1a2356e1f", "name": "diligent-prairie-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52210, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:58:53.161068+00:00", "ended_at": "2026-08-26T12:58:56.573468+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e0d6600-e3b8-4d8e-9661-dec4d6a28464", "name": "wistful-blunt-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45986, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:58:40.060410+00:00", "ended_at": "2026-08-26T12:58:52.891422+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "76ce5a3a-87ac-4e02-b3ef-11bc8f89c897", "name": "hollow-civil-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53136, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 486, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:58:17.985558+00:00", "ended_at": "2026-08-26T12:58:23.067142+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "faed28d6-e523-4e24-a8be-f354e2036b96", "name": "creaky-eager-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42786, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 523, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:58:04.140542+00:00", "ended_at": "2026-08-26T12:58:08.684463+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e2c0563-3c19-4458-9a1e-26a734320100", "name": "prairie-vaulted-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42118, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 573, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:57:55.178792+00:00", "ended_at": "2026-08-26T12:57:59.339999+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2f21110-8b8d-482c-8553-eae1c7eeff8f", "name": "grassy-ashen-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58982, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 619, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:57:45.195530+00:00", "ended_at": "2026-08-26T12:57:54.133204+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3f5edf80-1187-4378-91d2-6ccff36864b2", "name": "jagged-canny-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43710, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 645, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:57:35.269114+00:00", "ended_at": "2026-08-26T12:57:45.300535+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b1f0f2b2-8c0e-4595-a7ec-2a0c32087efc", "name": "orderly-merry-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54312, "username": "test1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:57:28.715390+00:00", "ended_at": "2026-08-26T12:57:38.452358+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "bbe8ce26-7a0f-437a-b2f0-efb48177fa32", "name": "hazel-ashen-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39056, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 654, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:57:02.523110+00:00", "ended_at": "2026-08-26T12:57:07.397865+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4c98fe78-7e1d-4c61-a54f-cae2322d43ff", "name": "sleepy-zealous-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43862, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:56:53.562813+00:00", "ended_at": "2026-08-26T12:56:58.025341+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e21d0b80-6dae-4cae-83d9-a3442a70c167", "name": "wistful-valiant-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44588, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:56:40.317350+00:00", "ended_at": "2026-08-26T12:56:44.077375+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11b65d9d-09a8-42c4-8f36-6094233473bc", "name": "frugal-plush-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48882, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 856, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:56:23.726104+00:00", "ended_at": "2026-08-26T12:56:24.969226+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "ad75e3c7-4f3b-4277-9720-ada9f93c1437", "name": "nautical-humble-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50052, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 384, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:56:19.838198+00:00", "ended_at": "2026-08-26T12:56:23.032749+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3eaae451-9733-46d7-9813-f691bdd3a350", "name": "jolly-freckled-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36764, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 439, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:56:04.271479+00:00", "ended_at": "2026-08-26T12:56:16.817695+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "804df2bc-16b0-4d89-8c0e-92087ea1827f", "name": "peaty-marbled-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39410, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 478, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:56:04.248488+00:00", "ended_at": "2026-08-26T12:56:09.609242+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5313acee-8fff-41f5-8b17-1b473227436b", "name": "craggy-blunt-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46124, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 411, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:55:45.543933+00:00", "ended_at": "2026-08-26T12:55:51.981214+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "751a1769-fc1f-4f66-94f6-e52b5ca93e1e", "name": "rambling-muted-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37616, "username": "dani", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:55:37.126613+00:00", "ended_at": "2026-08-26T12:55:40.018063+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7973503c-b6ad-4408-8875-0fd431a11542", "name": "spirited-frank-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59804, "username": "esroot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:55:29.614410+00:00", "ended_at": "2026-08-26T12:55:40.264017+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c44c1859-e908-4771-a403-1ee227219fbc", "name": "loyal-chilly-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44382, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:55:11.362323+00:00", "ended_at": "2026-08-26T12:55:15.338960+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0b0fe77-4b8a-4a78-a781-7cce90e4d301", "name": "shifting-tangled-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39528, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 782, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:54:58.576489+00:00", "ended_at": "2026-08-26T12:55:03.720402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a20fc49e-c647-4cfc-a377-825707e94b75", "name": "thrifty-marbled-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49774, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 342, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:54:42.322666+00:00", "ended_at": "2026-08-26T12:54:55.397244+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "15c2dfba-509e-4133-92a2-4950f6b8aa59", "name": "painted-obsidian-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37356, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:54:41.763551+00:00", "ended_at": "2026-08-26T12:54:48.014278+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0499cb2c-e68a-4daa-a1a2-2d18b6976be3", "name": "cobalt-feral-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58358, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 464, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:54:11.185350+00:00", "ended_at": "2026-08-26T12:54:15.158575+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a10a1a6-1256-47e4-b28a-c15b018d730b", "name": "leafy-bronzed-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37480, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 520, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:54:06.469053+00:00", "ended_at": "2026-08-26T12:54:11.314635+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "54db11b0-3b10-4f54-be24-c013156a0b9c", "name": "faded-boreal-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60764, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 418, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:53:48.440220+00:00", "ended_at": "2026-08-26T12:53:52.618704+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f6cd2478-af7c-48fa-b4b1-7cd1d704978d", "name": "frosty-tender-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50670, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 666, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:53:46.043423+00:00", "ended_at": "2026-08-26T12:53:55.992699+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "769cc704-6be2-4190-b4d9-94577d3282f5", "name": "weathered-frugal-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48686, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 851, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:53:31.835773+00:00", "ended_at": "2026-08-26T12:53:33.498135+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "42513193-fd6b-44ab-a323-ae940804d0bf", "name": "quaint-ruddy-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59260, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 395, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:53:25.519187+00:00", "ended_at": "2026-08-26T12:53:30.901013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3183e14c-c2ed-42bf-861f-30fa574f5ba2", "name": "thawing-drifting-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36912, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 637, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:53:14.693842+00:00", "ended_at": "2026-08-26T12:53:18.826007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30945e46-fd39-44fe-b1e1-16ab7b8d5a43", "name": "marbled-umber-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45412, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:53:02.861673+00:00", "ended_at": "2026-08-26T12:53:07.652710+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5e216218-163b-45aa-b1ac-f17f06b3907b", "name": "lanky-quaint-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38120, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 562, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:52:50.452426+00:00", "ended_at": "2026-08-26T12:52:53.881015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f52ec24c-44ad-4210-86b6-a5098234c4a0", "name": "velvet-downy-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34200, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 394, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:52:44.231784+00:00", "ended_at": "2026-08-26T12:52:52.772277+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "38e0a007-1285-4faa-aa4a-7df29c5707bf", "name": "vaulted-alpine-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39624, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:52:30.634508+00:00", "ended_at": "2026-08-26T12:52:44.798951+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "568e2664-807a-4ca6-bca6-3e2ede3a72c2", "name": "quiet-emerald-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42324, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 623, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:52:13.591495+00:00", "ended_at": "2026-08-26T12:52:17.945784+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "46fa9eef-1298-4ea2-8f85-049bbb950305", "name": "lucid-smooth-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47942, "username": "service", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 686, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:52:03.981951+00:00", "ended_at": "2026-08-26T12:52:16.618885+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "6609b1fe-b98c-4d11-bd7a-556aeb02e9d1", "name": "wandering-hardy-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32928, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 691, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:51:45.815990+00:00", "ended_at": "2026-08-26T12:51:49.990114+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92fcfdf9-0d18-429b-871d-e0c7fe8e956a", "name": "icy-fleeting-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42678, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 401, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:51:27.612470+00:00", "ended_at": "2026-08-26T12:51:31.489788+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6838a718-f2f9-4d1c-90c0-75ac21336ae3", "name": "gnarled-knotted-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54478, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:51:10.183235+00:00", "ended_at": "2026-08-26T12:51:16.490836+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42c7df13-bd86-4568-997d-539b2f1318b4", "name": "dapper-lucid-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34696, "username": "edge", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 582, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:51:07.484525+00:00", "ended_at": "2026-08-26T12:51:19.929456+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "eb280755-310f-46fc-97f2-c5a187322d29", "name": "merry-loyal-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35670, "username": "potok", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 634, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:50:59.977452+00:00", "ended_at": "2026-08-26T12:51:11.255479+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "722bf368-483e-4dac-99db-67390780a96e", "name": "mindful-wandering-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48490, "username": "mark", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 858, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:50:49.596202+00:00", "ended_at": "2026-08-26T12:50:50.894741+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "bbe48cb2-6b0a-4775-a403-574223ab9560", "name": "drifting-cosmic-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35384, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:50:34.790770+00:00", "ended_at": "2026-08-26T12:50:37.703693+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0c6f794-ca24-4369-b6d9-02b4999d6b2e", "name": "fabled-lanky-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35596, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 521, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:50:24.204472+00:00", "ended_at": "2026-08-26T12:50:29.989675+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3eab4aea-7c65-4355-8d40-8e9916cb3b7c", "name": "austere-jagged-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49536, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 549, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:50:15.609341+00:00", "ended_at": "2026-08-26T12:50:24.098280+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "1a7a1664-d917-4ac3-a000-66515efc5585", "name": "icy-cosmic-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60988, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:49:59.101741+00:00", "ended_at": "2026-08-26T12:50:02.148769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "446732b9-ca18-416c-8938-a736c2196dde", "name": "gallant-lunar-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33548, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 712, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:49:49.187781+00:00", "ended_at": "2026-08-26T12:49:52.811840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a5deb7d6-29a5-414c-b276-b81ef9d260d0", "name": "dappled-electric-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58934, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 507, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:49:31.141574+00:00", "ended_at": "2026-08-26T12:49:36.398589+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "067b9112-05e0-405a-a93b-0c6f985f1fea", "name": "obsidian-hazel-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57742, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 630, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:49:14.646736+00:00", "ended_at": "2026-08-26T12:49:18.877027+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "209d5693-da01-426c-9c68-a68bcae51c3c", "name": "fearless-crimson-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59916, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 737, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:49:00.768080+00:00", "ended_at": "2026-08-26T12:49:06.733631+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fa58064e-9b04-43fb-9e8e-c637a9f59f58", "name": "jaunty-drifting-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49364, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:48:50.135172+00:00", "ended_at": "2026-08-26T12:49:02.530176+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "ce85b0e2-012e-4edb-a165-ce83c5112e52", "name": "orderly-cobalt-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37706, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 411, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:48:48.421777+00:00", "ended_at": "2026-08-26T12:48:53.355596+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd1f6a27-2d14-40a9-ae4a-f22f5ed64033", "name": "jaunty-diligent-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51590, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:48:22.923688+00:00", "ended_at": "2026-08-26T12:48:28.775099+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d547babe-3adb-4bdd-b85b-ece8814c15d2", "name": "creaky-vaulted-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39910, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 464, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:48:16.160178+00:00", "ended_at": "2026-08-26T12:48:19.645009+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed78ff8b-f28a-42df-8a34-903fe480802a", "name": "curious-blazing-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48294, "username": "testUser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 870, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:48:03.193113+00:00", "ended_at": "2026-08-26T12:48:04.611804+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "29250cbe-ee87-43ba-b210-73dd2bdbc306", "name": "breezy-noble-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40922, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 603, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:48:01.545241+00:00", "ended_at": "2026-08-26T12:48:05.551546+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ca36af9b-9165-43df-85c0-e61c2225cf84", "name": "subtle-marbled-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53538, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 896, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:47:53.548152+00:00", "ended_at": "2026-08-26T12:47:56.841017+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "725546df-f7ba-4da8-a5e4-799b54d831b6", "name": "sturdy-spirited-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36102, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 822, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:47:52.580879+00:00", "ended_at": "2026-08-26T12:48:02.224326+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ea1349da-d19c-47cd-898f-a6ed795223be", "name": "earnest-frugal-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40424, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:47:28.096638+00:00", "ended_at": "2026-08-26T12:47:33.270728+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "002222b5-246a-44e9-92f4-347443030cd3", "name": "gritty-vivid-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55538, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 354, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:47:09.093556+00:00", "ended_at": "2026-08-26T12:47:13.767880+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6fac3614-ca78-44f5-891b-155ec588a22b", "name": "russet-wooded-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 46998, "username": "user7", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 588, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:46:55.530790+00:00", "ended_at": "2026-08-26T12:46:56.544114+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "c17c7783-11d7-45ae-8d11-b79b9b8ed722", "name": "smoky-grumpy-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39964, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 491, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:46:54.226944+00:00", "ended_at": "2026-08-26T12:46:59.195740+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed1d5e37-7bdf-46bf-a6e0-dc19ca16c4a3", "name": "feathered-windswept-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41022, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 644, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:46:45.435597+00:00", "ended_at": "2026-08-26T12:46:51.412118+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b64fbcfd-2dc5-45c0-a285-17671618a115", "name": "prickly-coastal-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42818, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:46:29.207605+00:00", "ended_at": "2026-08-26T12:46:33.502713+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b7ed3f9-17f4-4825-99c3-09aa02bf911c", "name": "wooded-granite-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38842, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:46:25.370296+00:00", "ended_at": "2026-08-26T12:46:31.269851+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9e86584-8a27-436d-9140-45ce94fb57d1", "name": "austere-proud-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42238, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:46:06.611331+00:00", "ended_at": "2026-08-26T12:46:12.368448+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47066562-71d9-4ad3-be44-e9527f8cd185", "name": "frank-flinty-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40322, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:45:58.223873+00:00", "ended_at": "2026-08-26T12:46:03.860175+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b747c136-8be1-4353-8524-095b2791015b", "name": "fringed-jaunty-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51100, "username": "user3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 682, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:45:47.063793+00:00", "ended_at": "2026-08-26T12:45:57.954840+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "99c8083c-0e2d-4467-b18b-4909423c46ac", "name": "wooded-rugged-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49244, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 678, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:45:22.556114+00:00", "ended_at": "2026-08-26T12:45:29.046275+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4003f62-4efb-45ee-993b-df2d0b2a7ee8", "name": "peaty-quartz-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48094, "username": "pokemon", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 873, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:45:19.307141+00:00", "ended_at": "2026-08-26T12:45:20.818277+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "1ad3ceb3-df8a-4600-b02e-4c87140fd06f", "name": "vaulted-sterling-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52994, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 802, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:45:15.807212+00:00", "ended_at": "2026-08-26T12:45:21.410926+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a20e036b-ee41-41b3-82cd-40f5b3254376", "name": "quartz-subtle-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42634, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:45:01.082554+00:00", "ended_at": "2026-08-26T12:45:05.525721+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba4b6cc5-21e1-4636-965c-05b53a4c2723", "name": "fearless-candid-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37552, "username": "work", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 570, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:44:48.964164+00:00", "ended_at": "2026-08-26T12:44:54.103839+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "98ad8433-dcf0-46b7-97cb-dba4d28bba83", "name": "leafy-tender-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38092, "username": "customer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 728, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:44:46.407174+00:00", "ended_at": "2026-08-26T12:44:53.686642+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "f3cf3087-e43b-47f3-bc36-4c30f6a6ff4f", "name": "indigo-mindful-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50352, "username": "dspace", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:44:34.912074+00:00", "ended_at": "2026-08-26T12:44:49.933426+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1c6dadb6-3e03-46cd-bd81-285b63c9f8f0", "name": "mindful-primal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57468, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 576, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:44:20.041686+00:00", "ended_at": "2026-08-26T12:44:31.717212+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "24de38dc-68b9-41de-9a1f-ce84a52d7175", "name": "salty-reedy-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45162, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 735, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:43:53.691629+00:00", "ended_at": "2026-08-26T12:43:57.079618+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae7ba865-8aac-4410-b046-c171db6cddb6", "name": "watchful-hearty-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54860, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:43:48.797966+00:00", "ended_at": "2026-08-26T12:44:03.168271+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "c271c946-1760-46f0-9204-a70fe2ac665e", "name": "chilly-fickle-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42430, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 605, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:43:23.978636+00:00", "ended_at": "2026-08-26T12:43:31.841343+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a9f9b667-4fdc-413e-a5f8-b0af1ae74c80", "name": "chilly-northern-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41920, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:43:23.074664+00:00", "ended_at": "2026-08-26T12:43:29.294820+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f7f2f5dd-ff1b-4ed2-8cbe-5cf934bde8c0", "name": "opal-sincere-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36444, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 569, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:43:09.240163+00:00", "ended_at": "2026-08-26T12:43:12.211362+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2205629e-14ba-45e2-8638-f7e909db29af", "name": "snowy-valiant-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47738, "username": "daniel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 679, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:43:02.944569+00:00", "ended_at": "2026-08-26T12:43:14.918178+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "41882669-7f54-4aa8-b71f-889c3624258e", "name": "obsidian-hearty-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56930, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 623, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:42:47.604361+00:00", "ended_at": "2026-08-26T12:42:52.981626+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9a5e1788-d8a5-4ac0-8a2a-4c6e1949b2c2", "name": "earnest-loyal-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 55832, "username": "default", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 613, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:42:47.442051+00:00", "ended_at": "2026-08-26T12:42:48.198826+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "f41e76a5-e6b6-44bb-b9b1-b6a5bb9d6ff7", "name": "meadow-genial-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47894, "username": "u1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 853, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:42:46.905584+00:00", "ended_at": "2026-08-26T12:42:48.039184+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "2bd4dc9f-cdb0-46ce-b4d3-2cf517580798", "name": "frugal-honest-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58936, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:42:32.292528+00:00", "ended_at": "2026-08-26T12:42:41.730523+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a8e4dc59-c5a0-4cfb-850a-d3f7fc0da497", "name": "bitter-languid-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48526, "username": "wizard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 638, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:42:26.477766+00:00", "ended_at": "2026-08-26T12:42:38.121414+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "19d00b24-4637-4c6f-9afe-b0833d4b23bf", "name": "weathered-nautical-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49676, "username": "test2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 564, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:42:11.638146+00:00", "ended_at": "2026-08-26T12:42:24.232728+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "542206e5-a48a-4fc0-837d-a8afcff32ff2", "name": "snowy-restless-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53462, "username": "kelly", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 685, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:41:48.643607+00:00", "ended_at": "2026-08-26T12:42:00.393966+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "42df55f7-b828-4e17-9194-5cd1282ed336", "name": "mellow-downy-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59838, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 436, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:41:27.286837+00:00", "ended_at": "2026-08-26T12:41:32.469313+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04493b1d-9bac-4cdb-afd9-e96075be405f", "name": "gnarled-jagged-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47210, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:41:11.773284+00:00", "ended_at": "2026-08-26T12:41:16.624602+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "adf57795-b9df-4f57-b7d2-8cc5dacdb13e", "name": "upland-fleeting-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49076, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:41:05.849146+00:00", "ended_at": "2026-08-26T12:41:10.472015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b6cdbad-6830-438b-af95-b55354041d63", "name": "wistful-crisp-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52440, "username": "joel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 411, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:40:56.240166+00:00", "ended_at": "2026-08-26T12:41:04.384740+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "462e4caa-8f62-4368-b1be-b98c66e93816", "name": "brave-frugal-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40998, "username": "kubernetes", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 616, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:40:51.232503+00:00", "ended_at": "2026-08-26T12:40:59.980922+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "3db0cc0f-57a8-47f3-aef1-1f2922a13940", "name": "lawful-balmy-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43392, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 670, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:40:32.305663+00:00", "ended_at": "2026-08-26T12:40:35.997207+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8dcd696-7004-4779-964e-3313b12db9a6", "name": "plucky-graceful-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35506, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:40:17.181237+00:00", "ended_at": "2026-08-26T12:40:21.065551+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c8bf84ca-d9ed-4a77-8bff-bcb166829e87", "name": "fabled-loyal-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47700, "username": "nitin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 886, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:40:09.299509+00:00", "ended_at": "2026-08-26T12:40:10.905325+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "d1d946e7-fe9a-41eb-bed6-be8268600949", "name": "somber-vigilant-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46540, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:40:03.244668+00:00", "ended_at": "2026-08-26T12:40:06.291455+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3e1a9d9-4ddf-4e3b-93c9-c7b6cbc59c50", "name": "zealous-twilight-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32780, "username": "bernard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 513, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:39:59.547087+00:00", "ended_at": "2026-08-26T12:40:10.397630+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "b3568201-f395-4d73-b9ee-18ec87b259f4", "name": "tidal-painted-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59466, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 563, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:39:32.486425+00:00", "ended_at": "2026-08-26T12:39:38.168567+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac149ec0-a270-4351-9111-ac856d2170e8", "name": "jaunty-prairie-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51096, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:39:21.025066+00:00", "ended_at": "2026-08-26T12:39:24.438514+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "600bec35-9ab5-4406-a07c-1a6428f3f1b2", "name": "wry-thawing-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48838, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:39:10.757879+00:00", "ended_at": "2026-08-26T12:39:15.109960+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed10f7ca-e99f-4ece-8b41-eeb76c9b2371", "name": "serene-cosmic-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39780, "username": "monitor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 477, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:38:59.427884+00:00", "ended_at": "2026-08-26T12:39:10.091460+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "a20220d2-e927-4bb2-a80d-cc0640441e05", "name": "languid-graceful-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58612, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 602, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:38:44.467134+00:00", "ended_at": "2026-08-26T12:38:48.152201+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58b07c3b-4a37-48e9-a8cf-614c3e612521", "name": "merry-arctic-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37654, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:38:25.449994+00:00", "ended_at": "2026-08-26T12:38:29.272738+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "23296692-f25b-4301-ae09-2d2489764b12", "name": "dapper-thorny-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36228, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 537, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:38:16.882856+00:00", "ended_at": "2026-08-26T12:38:21.164041+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "752dcf1b-1a9a-4603-b8f8-9c6933763abf", "name": "feral-creaky-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43790, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 486, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:38:04.152373+00:00", "ended_at": "2026-08-26T12:38:15.395715+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "68faf2f2-af2e-4dfe-a8d3-de0261a4ac10", "name": "dutiful-icy-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48440, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 523, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:38:01.837457+00:00", "ended_at": "2026-08-26T12:38:06.817902+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db023592-6a23-4ad0-a0fa-7ab8bacc870c", "name": "solemn-civil-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33680, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:37:57.085580+00:00", "ended_at": "2026-08-26T12:38:09.759249+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "3b498e4d-af38-489e-a312-1059578ef19f", "name": "ivory-languid-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47502, "username": "al", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 863, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:37:29.600578+00:00", "ended_at": "2026-08-26T12:37:31.337338+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "2d0298a0-8195-4d1b-89c8-86424b05f335", "name": "tranquil-fickle-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53656, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 582, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:37:25.386256+00:00", "ended_at": "2026-08-26T12:37:31.741453+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c8e89c6-66ac-4f32-9ce6-a323b5af1841", "name": "alpine-indigo-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52118, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 539, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:37:08.946442+00:00", "ended_at": "2026-08-26T12:37:13.590396+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7c3ec6e7-70f6-4ce7-ae7f-b805ffd17b42", "name": "downy-mottled-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55656, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:36:53.718514+00:00", "ended_at": "2026-08-26T12:36:56.723394+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4be05b8-4ed0-43bb-86c1-2573f19a69a6", "name": "flinty-upland-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39642, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:36:50.010738+00:00", "ended_at": "2026-08-26T12:36:55.565191+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf9b5be4-8621-475c-8876-da944a9c4b58", "name": "cheerful-steady-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58730, "username": "hamed", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:36:41.077492+00:00", "ended_at": "2026-08-26T12:36:51.475336+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b930ae98-143b-4253-846c-9b5884d52bea", "name": "downy-noble-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59674, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:36:29.222554+00:00", "ended_at": "2026-08-26T12:36:41.650304+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2f8bde1c-63f1-44f4-9ff4-cfce8a792bb2", "name": "gentle-marine-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32780, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 387, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:59.787287+00:00", "ended_at": "2026-08-26T12:36:04.274901+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a6141017-7b93-4e6d-b47c-3eedef71d6fc", "name": "mighty-jovial-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51654, "username": "hummingbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 599, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:58.853791+00:00", "ended_at": "2026-08-26T12:36:09.309334+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "f7267e01-35a6-4bfd-bab5-8334637c17ca", "name": "cobalt-gritty-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54216, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 500, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:45.007803+00:00", "ended_at": "2026-08-26T12:35:48.866847+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5786d337-5e87-436f-bf2f-265144cfdb0c", "name": "lucid-tranquil-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44000, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 361, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:29.041836+00:00", "ended_at": "2026-08-26T12:35:32.588293+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf9cf518-07a7-4586-a6e7-b2e8fd89179e", "name": "scarlet-dutiful-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43104, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 729, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:17.036607+00:00", "ended_at": "2026-08-26T12:35:21.457617+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "93feaced-5052-4b51-b8b6-5b681849bd21", "name": "thrifty-western-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36238, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 411, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:06.808639+00:00", "ended_at": "2026-08-26T12:35:11.923017+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4a12b502-2055-40f5-b317-12f602d8b107", "name": "rugged-bashful-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45138, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 648, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:35:05.737703+00:00", "ended_at": "2026-08-26T12:35:15.514877+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "78389d4b-de1b-403b-8ad2-5fa049110124", "name": "gleaming-crisp-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33428, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 402, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:34:43.145583+00:00", "ended_at": "2026-08-26T12:34:57.446023+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5e2cd64b-311b-46d2-a968-81bcb3cce1c4", "name": "bashful-primal-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47294, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 861, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:34:38.057535+00:00", "ended_at": "2026-08-26T12:34:39.429294+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "d6d0bed7-188d-4aad-a6f6-17906736e7c4", "name": "lawful-murky-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41116, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 346, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:34:20.107571+00:00", "ended_at": "2026-08-26T12:34:24.080035+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9595c15a-7c4e-432e-bacc-7561c16f3fc3", "name": "feathered-dapper-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49686, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 421, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:34:06.479405+00:00", "ended_at": "2026-08-26T12:34:09.887830+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6cd66531-d011-40b7-8df0-6bf6b14f0c7c", "name": "lonesome-dusty-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47650, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 431, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:34:03.797403+00:00", "ended_at": "2026-08-26T12:34:09.300649+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "046bd675-e3b1-44f4-b6c7-52539d3155cd", "name": "quaint-breezy-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37822, "username": "onkar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 588, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:33:38.178594+00:00", "ended_at": "2026-08-26T12:33:49.447049+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "1d162ea3-6c84-4094-94a0-8bb4707d7982", "name": "velvet-breezy-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 32880, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:33:38.034617+00:00", "ended_at": "2026-08-26T12:33:43.510316+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47d6040d-2754-4af9-8c4e-98ce1e7b924f", "name": "kindly-scarlet-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55206, "username": "grid", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 538, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:33:37.776677+00:00", "ended_at": "2026-08-26T12:33:48.503353+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "46d7b808-6a39-4278-b1a6-f4c0158c2b60", "name": "early-honest-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48540, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:33:04.018362+00:00", "ended_at": "2026-08-26T12:33:08.013458+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a3a91585-16db-40ef-9925-6393c88d998a", "name": "inland-tender-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60120, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 619, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:32:52.418893+00:00", "ended_at": "2026-08-26T12:32:57.846356+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3da56c8f-177e-4522-bb95-a5b6159910a6", "name": "coastal-languid-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50318, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 412, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:32:43.580563+00:00", "ended_at": "2026-08-26T12:32:47.479154+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f8583357-8237-4c7f-9d4b-ed9e73568ef2", "name": "earnest-sleepy-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52786, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:32:40.627710+00:00", "ended_at": "2026-08-26T12:32:52.889725+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "fd5e73d9-7a6d-480d-a664-5af3f8f8537f", "name": "merry-umber-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55540, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 810, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:32:22.007883+00:00", "ended_at": "2026-08-26T12:32:26.772328+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bd9a574-5387-4274-9834-4f4541d22e98", "name": "autumn-craggy-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38896, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:32:07.981502+00:00", "ended_at": "2026-08-26T12:32:13.345012+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae491ee0-d2ff-4c15-9e3f-4d6af1a3fbef", "name": "mellow-blunt-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58214, "username": "data", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 375, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:31:58.025661+00:00", "ended_at": "2026-08-26T12:32:09.603398+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "eb27f786-f25a-4b14-851a-9c3d83201752", "name": "russet-granite-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47094, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 844, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:31:47.892818+00:00", "ended_at": "2026-08-26T12:31:49.654955+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "31d0c0da-6d88-46f4-b8d4-cd3bc20814ca", "name": "rapid-bronzed-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50650, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 369, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:31:41.513745+00:00", "ended_at": "2026-08-26T12:31:45.468012+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "24af917c-c975-4918-8dbb-68656cac4acc", "name": "stormy-regal-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35024, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 409, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:31:21.687116+00:00", "ended_at": "2026-08-26T12:31:24.420390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae495d57-1619-4d1b-837e-ed6f79a3032f", "name": "western-meadow-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60148, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:31:08.830436+00:00", "ended_at": "2026-08-26T12:31:12.688577+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b205b331-9a37-45cc-b540-e6b801f5052d", "name": "jaunty-somber-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:31:00.796929+00:00", "ended_at": "2026-08-26T12:31:05.052950+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2377aa38-65f1-4767-a2a9-9af1df0722db", "name": "burly-somber-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37600, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 404, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:30:50.609074+00:00", "ended_at": "2026-08-26T12:30:54.950852+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bc7f3462-041d-4207-a0a6-875d1046d1f8", "name": "graceful-arctic-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42194, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:30:35.669510+00:00", "ended_at": "2026-08-26T12:30:39.290070+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90fb8877-0bf3-4cc4-a50b-e76bfb7b11a1", "name": "marbled-bold-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44028, "username": "omm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 485, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:30:27.521198+00:00", "ended_at": "2026-08-26T12:30:39.913642+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "466601e1-e380-4e9f-b1ad-677d4f9558c2", "name": "smoky-nautical-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49362, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:30:04.061016+00:00", "ended_at": "2026-08-26T12:30:09.825591+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7a5034bc-439b-4bb8-815c-de3e09f99260", "name": "glassy-fringed-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42706, "username": "zlm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 653, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:29:58.265661+00:00", "ended_at": "2026-08-26T12:30:11.579094+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ca3706ef-de3d-4174-baee-98177a4a0e73", "name": "woven-drifting-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59792, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 477, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:29:50.881684+00:00", "ended_at": "2026-08-26T12:30:04.314080+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "a2714e3e-9b32-4db6-a58a-b0d518f20498", "name": "inland-jagged-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59512, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 557, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:29:27.160926+00:00", "ended_at": "2026-08-26T12:29:34.926662+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b18350d8-8a7f-4759-917e-f5aab7ee07cc", "name": "chilly-humble-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40384, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 374, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:29:26.677158+00:00", "ended_at": "2026-08-26T12:29:30.934386+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b471a8a-00a5-4b90-adbc-96c53360782a", "name": "solemn-kindly-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47770, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:28:59.542013+00:00", "ended_at": "2026-08-26T12:29:03.975141+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "83c1f362-6885-4459-ba37-75cbbef41b55", "name": "gloomy-oaken-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56464, "username": "opc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 581, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:28:55.423314+00:00", "ended_at": "2026-08-26T12:29:05.920944+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0d06f611-316d-4998-9197-dca43e2f1d03", "name": "autumn-gleaming-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46894, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 879, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:28:54.695359+00:00", "ended_at": "2026-08-26T12:28:56.430434+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "09a1ec01-e24c-4e5a-992e-1d1d887db446", "name": "coastal-airy-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51534, "username": "lucas", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 597, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:28:38.175632+00:00", "ended_at": "2026-08-26T12:28:53.063079+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "f84cbe68-2068-4629-92ba-004970f795c5", "name": "indigo-hidden-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55782, "username": "rancher", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:28:22.013242+00:00", "ended_at": "2026-08-26T12:28:31.404658+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "40981d5b-430b-45b5-ab30-f6ec2373b500", "name": "thorny-chilly-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55020, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 395, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:28:05.825502+00:00", "ended_at": "2026-08-26T12:28:08.793615+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2def5477-2bbd-444c-a7fc-414d7be9b174", "name": "gentle-misty-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46826, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:28:05.562927+00:00", "ended_at": "2026-08-26T12:28:13.567536+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "8eebb20c-4338-4603-966f-79fc086c2698", "name": "hearty-thrifty-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47218, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:27:49.946605+00:00", "ended_at": "2026-08-26T12:27:55.566494+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6ca49213-7a95-4e68-9173-0f1dd1e48624", "name": "ginger-mossy-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44154, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 784, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:27:31.547669+00:00", "ended_at": "2026-08-26T12:27:35.119729+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70f678c3-bfc2-4eb6-b80e-89e31b43979f", "name": "frugal-thrifty-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42094, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 760, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:27:24.270686+00:00", "ended_at": "2026-08-26T12:27:29.491068+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f434af29-f07b-449e-94c6-f4040c81372c", "name": "frank-vaulted-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56238, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 489, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:27:09.866446+00:00", "ended_at": "2026-08-26T12:27:13.502567+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70caa483-d8e2-4322-9107-5ae0ec5a6cd2", "name": "regal-rapid-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39506, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 623, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:27:06.742294+00:00", "ended_at": "2026-08-26T12:27:16.187331+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "22e9beb5-6805-4123-b182-9b2312aab808", "name": "misty-feathered-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51532, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 561, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:26:45.725258+00:00", "ended_at": "2026-08-26T12:26:57.057729+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "76115ea6-5092-4f2c-b113-2e1a5ff1980e", "name": "coastal-lucid-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46906, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:26:44.526508+00:00", "ended_at": "2026-08-26T12:26:48.810663+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "93437396-3d9d-4b61-adb7-43384cec9f9e", "name": "western-crystal-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53686, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:26:19.500066+00:00", "ended_at": "2026-08-26T12:26:26.370066+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90967c2e-631d-4651-b13d-c1a3a302f9ba", "name": "hushed-daring-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46696, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 878, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:26:11.600364+00:00", "ended_at": "2026-08-26T12:26:12.993685+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "25af2650-6bb3-484e-b902-109c70b6be27", "name": "buoyant-opal-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48656, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 539, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:26:03.769367+00:00", "ended_at": "2026-08-26T12:26:08.307632+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8ddacb8-359d-426e-af62-b56abc918df0", "name": "emerald-dusky-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51586, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 939, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:26:01.785590+00:00", "ended_at": "2026-08-26T12:26:12.040390+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "1c15d8ba-24de-43f6-a63a-d97a58f01e86", "name": "granite-alpine-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54290, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 673, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:25:57.439508+00:00", "ended_at": "2026-08-26T12:26:00.675007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a2a65e9-5934-4a35-b007-bb0a8890fbe5", "name": "rambling-idle-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59374, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 640, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:25:41.728186+00:00", "ended_at": "2026-08-26T12:25:47.716533+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f3bffe3a-f925-4cb0-881b-fadd46ae51f4", "name": "austere-gnarled-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 60674, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:25:26.582652+00:00", "ended_at": "2026-08-26T12:25:27.329372+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "cce6be0c-65cc-4990-8489-528051c47a9d", "name": "ginger-reedy-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45182, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 690, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:25:24.759398+00:00", "ended_at": "2026-08-26T12:25:28.169147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f8d25557-7644-42af-9d8d-d3d21b00a1c2", "name": "noble-calm-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34064, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 888, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:25:12.185280+00:00", "ended_at": "2026-08-26T12:25:16.947162+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5297858c-7435-4f85-b945-8272d31900f2", "name": "spirited-courtly-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37588, "username": "martin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 511, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:25:04.962097+00:00", "ended_at": "2026-08-26T12:25:21.947510+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7777053d-8b6b-45d7-ae8b-8b53cfc5914e", "name": "freckled-genial-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37224, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 665, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:25:03.725810+00:00", "ended_at": "2026-08-26T12:25:08.584080+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d0080dd-fd0c-48b8-896c-0520095fbe2d", "name": "leafy-windswept-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43250, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 519, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:24:43.715570+00:00", "ended_at": "2026-08-26T12:24:48.329529+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd642fd7-c161-4130-a53e-430999a18169", "name": "burly-diligent-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41762, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:24:23.880609+00:00", "ended_at": "2026-08-26T12:24:29.480016+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2bfad896-a9ba-4e51-a999-495caf0f4ac3", "name": "misty-nimble-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50544, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 599, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:24:11.596496+00:00", "ended_at": "2026-08-26T12:24:16.316675+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f7ff9b1-89fe-415c-906f-9246219f73ae", "name": "alpine-amber-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35542, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 582, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:24:05.810476+00:00", "ended_at": "2026-08-26T12:24:10.358196+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07fc4f88-4eb5-46d2-96f7-3b5605152b75", "name": "chilly-earnest-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 489, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:23:49.606565+00:00", "ended_at": "2026-08-26T12:23:53.958908+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a79afc1b-5d67-4372-91b6-cf26228ad2c8", "name": "verdant-lanky-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46502, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 859, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:23:35.889598+00:00", "ended_at": "2026-08-26T12:23:37.501096+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "4a4b6b96-558c-4f7b-84f7-33fd31af7eaa", "name": "genial-rapid-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56394, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:23:33.922785+00:00", "ended_at": "2026-08-26T12:23:39.708119+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e02e517b-9c16-448f-9e08-91fa58804808", "name": "alpine-frank-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41800, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:23:20.877688+00:00", "ended_at": "2026-08-26T12:23:25.314861+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "732eb02d-7e4c-4e4d-acbe-30932db88061", "name": "fabled-early-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49164, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 340, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:23:08.542665+00:00", "ended_at": "2026-08-26T12:23:14.735199+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8cbab34e-8206-4297-a5ad-82138ec62178", "name": "painted-mottled-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37612, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 599, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:22:59.077689+00:00", "ended_at": "2026-08-26T12:23:05.319918+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "63a598f2-3ffb-402e-8a28-649f0e316c9c", "name": "sleepy-hazy-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59272, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 496, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:22:43.787190+00:00", "ended_at": "2026-08-26T12:22:48.636961+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85572ab0-4c06-4901-9820-b01da7da418d", "name": "painted-deft-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40542, "username": "zahra", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:22:38.479644+00:00", "ended_at": "2026-08-26T12:22:48.309379+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "5dd62462-7153-43bd-840a-a3fa86b2e665", "name": "fringed-hazy-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39574, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:22:32.872559+00:00", "ended_at": "2026-08-26T12:22:44.790839+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "19072d2b-c110-4cde-a765-fa1aaf18031f", "name": "weathered-wandering-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52422, "username": "vpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:22:18.610887+00:00", "ended_at": "2026-08-26T12:22:26.608338+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "b76d85c1-54c2-4745-8edb-3af002f98aca", "name": "gritty-lonesome-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51808, "username": "super", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 400, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:22:00.796645+00:00", "ended_at": "2026-08-26T12:22:10.749960+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "7a14dae9-a68f-40d8-a72b-69a49774981e", "name": "hushed-crisp-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39678, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 415, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:21:39.700390+00:00", "ended_at": "2026-08-26T12:21:43.368441+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fc4b91cf-99ed-4f15-9858-4f7c0196fe51", "name": "hardy-austere-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:21:34.495682+00:00", "ended_at": "2026-08-26T12:21:38.917678+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3d52e9f-cfba-4cee-bc0d-b28eda0ca7cc", "name": "calm-crystal-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52290, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 409, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:21:12.237605+00:00", "ended_at": "2026-08-26T12:21:17.468355+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3297d59d-7971-4c42-8611-2517d17cf8fd", "name": "eager-gnarled-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60294, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 694, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:21:10.720855+00:00", "ended_at": "2026-08-26T12:21:19.802208+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a17bd91b-bc88-41f7-99e9-c235c12c7cd0", "name": "faded-hazel-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60754, "username": "teste", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:20:55.675855+00:00", "ended_at": "2026-08-26T12:21:00.538454+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5105c764-41be-4799-9919-317103f5e077", "name": "gleaming-daring-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46286, "username": "junin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 866, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:20:52.729954+00:00", "ended_at": "2026-08-26T12:20:53.790316+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "da73558c-0f31-44af-8eb5-20d7c25f2965", "name": "thorny-emerald-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54174, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 382, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:20:34.805551+00:00", "ended_at": "2026-08-26T12:20:38.776621+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "acb9264f-9b5c-4428-b143-db8b6bcb046d", "name": "gallant-shaded-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58420, "username": "kevin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 440, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:20:33.409584+00:00", "ended_at": "2026-08-26T12:20:43.126775+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "ca1bb215-8ea6-420a-9d1c-f33c1b592e98", "name": "golden-foggy-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52734, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:20:10.167772+00:00", "ended_at": "2026-08-26T12:20:13.026483+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3b06ce73-1baf-455c-b9ac-d77dbd2b0186", "name": "sincere-seaward-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48636, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 819, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:19:57.972996+00:00", "ended_at": "2026-08-26T12:20:03.195422+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6520eaaa-8d4f-4fc7-a608-29726bc40df5", "name": "golden-ginger-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40604, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 822, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:19:47.575025+00:00", "ended_at": "2026-08-26T12:19:51.605835+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ceac974f-b5b2-4514-9214-c3a2ad82526d", "name": "muted-rapid-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59136, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1040, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:19:34.778704+00:00", "ended_at": "2026-08-26T12:19:39.751567+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f8bae0ec-d494-48f9-b0b1-383044765f80", "name": "slender-burly-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 908, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:19:13.474957+00:00", "ended_at": "2026-08-26T12:19:17.314341+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee879b62-795c-4761-8c2a-650a8521f64a", "name": "fierce-mottled-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45868, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 612, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:19:10.254834+00:00", "ended_at": "2026-08-26T12:19:22.944169+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1669 }, { "id": "9e39d837-e731-49d8-861c-9069e065ae29", "name": "frosty-balmy-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52006, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 927, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:18:59.848896+00:00", "ended_at": "2026-08-26T12:19:20.949189+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "8078563f-94ee-4828-a6cb-d5847cc0ca4e", "name": "fringed-regal-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52106, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:18:35.485440+00:00", "ended_at": "2026-08-26T12:18:39.262062+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1347962e-802c-43d7-814a-3a7127b6575b", "name": "pleasant-smoky-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46198, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 375, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:18:16.819145+00:00", "ended_at": "2026-08-26T12:18:22.085705+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bbdfacfe-1601-4a08-b3b9-dbe5d03dc9aa", "name": "primal-rugged-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48988, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 471, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:18:14.755892+00:00", "ended_at": "2026-08-26T12:18:17.686576+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf2acddd-96f5-4f8f-a250-7235fafc5f74", "name": "quartz-merry-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46086, "username": "casa", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 866, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:18:12.687619+00:00", "ended_at": "2026-08-26T12:18:13.899076+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2234 }, { "id": "1011ba7a-6fb2-41a4-8448-9e895941980b", "name": "frank-verdant-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57822, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 574, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:18:01.498078+00:00", "ended_at": "2026-08-26T12:18:05.639023+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d0c84a6f-cbdf-4679-90b6-2da258957f10", "name": "coastal-arctic-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37532, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 542, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:17:54.857125+00:00", "ended_at": "2026-08-26T12:17:58.219690+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ea2fe0dc-63cc-4a20-8473-fc45e4197706", "name": "rapid-steady-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58364, "username": "user4", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:17:44.601788+00:00", "ended_at": "2026-08-26T12:17:52.628634+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "c28e7da2-61c4-4fac-b121-189ca10ec555", "name": "crystal-serene-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49080, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 887, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:17:40.202773+00:00", "ended_at": "2026-08-26T12:17:43.665823+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef49f85e-3d80-4c3c-895b-826be3a65d34", "name": "frugal-mossy-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45056, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 951, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:17:30.501014+00:00", "ended_at": "2026-08-26T12:17:36.118833+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8c8a9c4-34f1-454e-8580-c2fb30eec24f", "name": "marbled-jaunty-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56940, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 927, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:17:09.017948+00:00", "ended_at": "2026-08-26T12:17:14.664566+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ebf3f6e8-620b-4aad-9e8a-b96e413e9a9e", "name": "faded-regal-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51898, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:16:57.410038+00:00", "ended_at": "2026-08-26T12:17:04.187872+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73863ef6-1f6f-4897-af45-1c5a57f6396d", "name": "genial-bold-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 39626, "username": "andrey", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 601, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:16:47.678353+00:00", "ended_at": "2026-08-26T12:16:48.455967+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "83714b9e-3ee3-4c7f-813a-7d0853909fb3", "name": "tawny-dusty-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36826, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 958, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:16:39.682089+00:00", "ended_at": "2026-08-26T12:16:46.624412+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "50b96774-9c59-425a-8521-f27f5b8dcff4", "name": "dusky-eager-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49766, "username": "ivan", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 616, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:16:36.288780+00:00", "ended_at": "2026-08-26T12:17:14.583145+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "b84ddd96-3ca9-4aab-bdbc-cb216ae0774e", "name": "twilight-inland-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39850, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 691, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:16:30.075036+00:00", "ended_at": "2026-08-26T12:16:36.093797+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b2443e7c-ef45-4e0b-b2bd-e31bb91e699a", "name": "smoky-canny-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39580, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 926, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:16:14.378581+00:00", "ended_at": "2026-08-26T12:16:19.104844+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f7876baa-0189-4b75-8f6b-7dce8ea1715b", "name": "loyal-wandering-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33342, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:16:00.275916+00:00", "ended_at": "2026-08-26T12:16:03.753512+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3cee6f19-a370-4fb6-9377-8e13d038d76d", "name": "clever-brisk-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44864, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1179, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:15:51.078791+00:00", "ended_at": "2026-08-26T12:15:56.577898+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f8b4e480-6eb9-43b4-a8e6-d0eedd0f41e1", "name": "tidal-mindful-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47610, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1381, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:15:49.222138+00:00", "ended_at": "2026-08-26T12:15:55.434109+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b04b7e2a-ecc4-4553-9536-7c38914e3a31", "name": "muted-hazel-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53164, "username": "mcserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1716, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:15:40.889104+00:00", "ended_at": "2026-08-26T12:16:02.413102+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "72f139c4-66fa-4111-b254-65841d7e3f3b", "name": "stormy-plush-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 36768, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1058, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:15:25.105119+00:00", "ended_at": "2026-08-26T12:15:31.129059+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8214b350-ff89-48e2-8fc9-1322ba610469", "name": "proud-granite-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45894, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 841, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:15:22.489710+00:00", "ended_at": "2026-08-26T12:15:23.905239+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "0b9f0e59-6863-4301-a4a7-6361752915e9", "name": "brisk-fleeting-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57802, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:15:04.994676+00:00", "ended_at": "2026-08-26T12:15:10.773233+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c49ab4fd-1ce9-4cd0-bb9a-b8dae4253d5b", "name": "lanky-granite-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48310, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:15:00.297289+00:00", "ended_at": "2026-08-26T12:15:05.693411+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7c4d5897-711c-4c23-ba1f-7471fcba2bdb", "name": "silent-mellow-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54274, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 638, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:14:48.650928+00:00", "ended_at": "2026-08-26T12:14:53.319829+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "36467011-1ea6-433b-9d61-0b09593b5220", "name": "icy-umber-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 826, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:14:42.513691+00:00", "ended_at": "2026-08-26T12:14:45.978264+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "62d015ab-cccb-41a2-bd6f-a66c962d204f", "name": "brazen-vivid-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46278, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 949, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:14:26.667283+00:00", "ended_at": "2026-08-26T12:14:31.198936+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3009364-dd01-4568-9cd9-4f93e826103d", "name": "mighty-plush-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59514, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1119, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:14:20.370342+00:00", "ended_at": "2026-08-26T12:14:25.921634+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "181bc5d0-cc52-4f40-88ff-a5c710d6c80b", "name": "lively-deft-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43376, "username": "jakob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 991, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:14:16.137258+00:00", "ended_at": "2026-08-26T12:14:24.632863+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e6549034-d307-4e71-a720-3268d18ead68", "name": "meadow-civil-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43430, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 951, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:14:06.687142+00:00", "ended_at": "2026-08-26T12:14:12.335786+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c31de716-4406-4434-953d-0691c39dcc7c", "name": "glacial-clever-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35486, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1164, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:13:52.874711+00:00", "ended_at": "2026-08-26T12:13:56.187328+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff580137-b759-46b2-9a30-75172b4814ac", "name": "merry-stoic-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41668, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1038, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:13:42.670832+00:00", "ended_at": "2026-08-26T12:13:45.725516+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f565c60c-3177-44a7-aa2e-c07fa2731777", "name": "upland-cosmic-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52260, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 960, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:13:28.716159+00:00", "ended_at": "2026-08-26T12:13:33.346511+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d337b86-e8b9-4c34-b9b2-e84be293b97f", "name": "loyal-dewy-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57010, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 735, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:13:06.281872+00:00", "ended_at": "2026-08-26T12:13:10.854470+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "76207f1e-6b6e-4b1b-b5e2-6b07c1e686c0", "name": "smoky-sunlit-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40602, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 506, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:12:51.427037+00:00", "ended_at": "2026-08-26T12:12:56.057006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2a284657-cbe0-4534-8bc2-ebc406d78b14", "name": "genial-arctic-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59366, "username": "gns3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 489, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:12:50.850861+00:00", "ended_at": "2026-08-26T12:13:11.708864+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "41ec9c90-cb07-4820-bc0c-b2b99517f0b6", "name": "chilly-ancient-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45700, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 857, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:12:36.692031+00:00", "ended_at": "2026-08-26T12:12:38.092738+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2271 }, { "id": "e0c20725-4736-4499-b6ce-c3d0651e2e49", "name": "seaward-rapid-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 41226, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:12:32.222078+00:00", "ended_at": "2026-08-26T12:12:33.043134+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "9db5d0c2-42ee-4a2f-97bd-5fb44f56ed3b", "name": "somber-diligent-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45372, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 406, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:12:28.866140+00:00", "ended_at": "2026-08-26T12:12:33.024810+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b273d260-6ad4-4c7e-934f-589053b0588f", "name": "cunning-downy-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37122, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:12:13.549712+00:00", "ended_at": "2026-08-26T12:12:17.308408+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "119a62dc-cfff-4598-9009-4768eff07876", "name": "icy-regal-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55806, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:12:09.272088+00:00", "ended_at": "2026-08-26T12:12:19.439293+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "7faf6040-1b95-44cf-a159-f3e78798cc32", "name": "dusty-nautical-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48618, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 584, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:11:59.653139+00:00", "ended_at": "2026-08-26T12:12:07.519757+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3baea7bb-c080-4cba-8a92-7085c9677ef9", "name": "inland-vaulted-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40548, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:11:41.604664+00:00", "ended_at": "2026-08-26T12:11:55.163811+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "d50e8fb1-aa2d-4b4c-9324-65a970c8e96a", "name": "balmy-misty-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41904, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 763, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:11:21.697325+00:00", "ended_at": "2026-08-26T12:11:31.023510+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e9e41b2b-b8c5-4fe9-ba4b-8ac5487b78ed", "name": "scarlet-mossy-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41916, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 491, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:11:19.426546+00:00", "ended_at": "2026-08-26T12:11:23.618262+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6645c75a-b769-4c41-ac4e-d1f53d970ea3", "name": "craggy-burly-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34456, "username": "t1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:11:03.231668+00:00", "ended_at": "2026-08-26T12:11:13.435253+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "cc5a118b-da67-4cd4-88db-dda248ba9a3e", "name": "steady-balmy-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60918, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:10:41.639362+00:00", "ended_at": "2026-08-26T12:10:45.531013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e1698496-f454-48f6-846d-3150f110b003", "name": "fringed-blunt-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35790, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 619, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:10:36.906949+00:00", "ended_at": "2026-08-26T12:10:49.714958+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "4ec46512-c482-4646-b8b3-794d0d7db5dc", "name": "balmy-glassy-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53900, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 423, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:10:27.615352+00:00", "ended_at": "2026-08-26T12:10:37.037278+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "e7f7cff6-d4c9-4441-9934-04ddcd219d72", "name": "vigilant-sturdy-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54078, "username": "odoo16", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 612, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:10:17.560237+00:00", "ended_at": "2026-08-26T12:10:27.826138+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a587da40-b85a-40a8-949d-d1536c33a889", "name": "proud-lunar-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39092, "username": "vbox", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 659, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:10:01.073921+00:00", "ended_at": "2026-08-26T12:10:10.828232+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d88fad72-1dfe-4cd0-89ea-e697cf6dd402", "name": "wiry-tangled-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45496, "username": "prashant", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 841, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:09:47.414572+00:00", "ended_at": "2026-08-26T12:09:49.015012+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2215 }, { "id": "419eda35-192a-4f75-9fa5-2410a0b98205", "name": "icy-vaulted-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40900, "username": "vagrant", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 808, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:09:39.685306+00:00", "ended_at": "2026-08-26T12:09:50.033522+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "5e6c9b3c-38ff-4da5-87d8-e9c1272cb4f5", "name": "forlorn-mindful-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43556, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 604, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:09:39.463494+00:00", "ended_at": "2026-08-26T12:09:44.729392+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e50cf080-55d4-4fe4-974c-3903ccbe374f", "name": "electric-vigilant-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39448, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 670, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:09:21.605898+00:00", "ended_at": "2026-08-26T12:09:33.697544+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "609be38c-14c9-45a4-9dff-6848a6dc3402", "name": "gritty-proud-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35230, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 810, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:08:50.407276+00:00", "ended_at": "2026-08-26T12:08:56.246627+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8c02a64-c75c-4fdd-90dc-a14bce8e3fba", "name": "oaken-tangled-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55620, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 701, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:08:45.385699+00:00", "ended_at": "2026-08-26T12:08:50.702812+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ca237e0d-2ea6-4c6e-9a40-735d8434e047", "name": "tangled-smooth-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52498, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 563, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:08:28.860565+00:00", "ended_at": "2026-08-26T12:08:34.164494+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37f814eb-b179-423b-a125-70a143f67301", "name": "mottled-silent-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56114, "username": "christianna", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 554, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:08:21.884607+00:00", "ended_at": "2026-08-26T12:08:30.842845+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "48d9bf38-ef43-4692-98b8-0ee840566ed9", "name": "languid-bronzed-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33448, "username": "orange", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 470, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:07:54.557351+00:00", "ended_at": "2026-08-26T12:08:06.184015+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "14f65a10-600d-4217-8a68-517cc79d3025", "name": "smooth-crimson-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46014, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 425, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:07:52.975993+00:00", "ended_at": "2026-08-26T12:07:57.774414+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "46c8ad29-5b2f-44f1-9179-d76095f1a51e", "name": "granite-ashen-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49900, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:07:32.648457+00:00", "ended_at": "2026-08-26T12:07:42.011092+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c8c47fcc-1e88-4391-a142-a67c664ee3a6", "name": "salty-opal-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34218, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:07:32.627613+00:00", "ended_at": "2026-08-26T12:07:38.481592+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "838d16ba-a37f-46ac-8a31-df87bd2e32c0", "name": "rustic-gentle-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51462, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:07:11.687699+00:00", "ended_at": "2026-08-26T12:07:16.249719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "98961eec-94b9-4f7a-b4e8-1e69d08563d7", "name": "frank-lunar-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45302, "username": "lg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 877, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:07:03.286379+00:00", "ended_at": "2026-08-26T12:07:04.427112+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2186 }, { "id": "c6582c68-f3b8-4f32-ab79-381bd27aa82a", "name": "sincere-coastal-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52654, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 436, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:06:51.054521+00:00", "ended_at": "2026-08-26T12:06:54.520584+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a64b81f-3d1d-4a2a-a6ba-5308994ff60c", "name": "subtle-vernal-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58392, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 659, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:06:42.801680+00:00", "ended_at": "2026-08-26T12:06:51.713768+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f5af1fd4-232d-42f2-b7eb-1b9445cf95d2", "name": "plush-velvet-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41948, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:06:36.651594+00:00", "ended_at": "2026-08-26T12:06:42.885146+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e638e276-660e-492c-b7c7-490cdb8aa5df", "name": "proud-buoyant-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38560, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 668, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:06:21.386263+00:00", "ended_at": "2026-08-26T12:06:28.420813+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "04fe2aea-9f0d-4aa0-bd9a-ea91bc0677ac", "name": "meadow-loyal-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55344, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:06:12.006228+00:00", "ended_at": "2026-08-26T12:06:22.597831+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "e9e2473f-8b4c-4914-a6c0-029a85ce2bbf", "name": "quiet-vigilant-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48092, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 597, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:05:57.864929+00:00", "ended_at": "2026-08-26T12:06:14.006746+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3950df56-d06f-4c9a-919b-acbb23ebb696", "name": "crimson-airy-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41402, "username": "term2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 424, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:05:37.449513+00:00", "ended_at": "2026-08-26T12:05:49.272261+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "664e78d3-35ec-44b7-9b49-bc4f656b6355", "name": "lanky-dapper-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47940, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 664, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:05:32.651374+00:00", "ended_at": "2026-08-26T12:05:36.555815+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "daaf3fe1-9222-4b4a-9d81-80ac08155a14", "name": "grassy-coastal-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54220, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 615, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:05:12.978839+00:00", "ended_at": "2026-08-26T12:05:18.738946+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bad07c8f-cbab-49cf-924b-3f55d53986d2", "name": "rustic-cunning-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53432, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 477, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:04:59.485222+00:00", "ended_at": "2026-08-26T12:05:08.748231+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "6f64b309-7dff-4cf5-9b3b-eb4bb59316ec", "name": "velvet-stormy-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54862, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:04:52.979147+00:00", "ended_at": "2026-08-26T12:05:02.397554+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "01f2920a-0697-4cd5-ba2b-6102a7b67f0b", "name": "shaded-tangled-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59908, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 470, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:04:26.831461+00:00", "ended_at": "2026-08-26T12:04:31.071950+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b2fde54a-8381-4551-aaaf-6641981b61a8", "name": "dewy-gallant-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45100, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 843, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:04:21.388571+00:00", "ended_at": "2026-08-26T12:04:22.525117+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2189 }, { "id": "bed6e201-a2ab-42dd-8046-2a72edd08058", "name": "coastal-icy-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52228, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:04:13.824428+00:00", "ended_at": "2026-08-26T12:04:18.897011+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1da400e7-982d-4dda-a441-70ab6b8b20dd", "name": "vigilant-bashful-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41200, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:04:08.112755+00:00", "ended_at": "2026-08-26T12:04:13.137208+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4927ca98-df7c-4818-a6fa-628b6f87d236", "name": "granite-solar-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51096, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 488, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:03:51.353612+00:00", "ended_at": "2026-08-26T12:03:55.604448+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "768687a6-8c85-47ec-a8e4-3b47501a8e02", "name": "supple-upland-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42900, "username": "usuario", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 610, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:03:49.418812+00:00", "ended_at": "2026-08-26T12:03:57.448250+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "6426a9de-35b5-488e-bf8c-60ef5aeff4ba", "name": "chilly-airy-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38944, "username": "user10", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 563, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:03:30.376054+00:00", "ended_at": "2026-08-26T12:03:40.217240+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5af0a729-8289-4eb6-92cc-2b78d1f4bfb8", "name": "creaky-sleepy-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41838, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 761, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:03:25.523895+00:00", "ended_at": "2026-08-26T12:03:33.695424+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "66456b19-8775-47e4-a8da-bbdb5b15ba84", "name": "reedy-amber-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43440, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 486, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:03:00.487932+00:00", "ended_at": "2026-08-26T12:03:05.313164+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86fccb70-8cc3-4b0d-aa7a-997d8b2ce89f", "name": "marine-buoyant-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49570, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 599, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:02:40.338552+00:00", "ended_at": "2026-08-26T12:02:51.869609+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1671 }, { "id": "720ba6fe-107a-40f3-b943-57a54a9a3516", "name": "marbled-early-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34810, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:02:39.734453+00:00", "ended_at": "2026-08-26T12:02:44.658416+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b607e4b1-8409-4bbe-90a7-89d5b6021f89", "name": "fearless-lawful-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 57194, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 570, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:02:22.655548+00:00", "ended_at": "2026-08-26T12:02:35.295764+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "202dd45b-81f9-4237-81b0-646ba92409b2", "name": "pristine-peaty-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45850, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 651, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:02:14.766316+00:00", "ended_at": "2026-08-26T12:02:29.233236+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a2747a8d-c5a9-49e2-a646-526de9bb61f8", "name": "fringed-muted-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52220, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 606, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:01:48.174726+00:00", "ended_at": "2026-08-26T12:01:51.931693+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cb59183a-5bca-49a1-8223-53960a98c1b9", "name": "crystal-watchful-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44894, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 875, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:01:41.488922+00:00", "ended_at": "2026-08-26T12:01:43.152346+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2188 }, { "id": "5694d4a3-3a30-4e2b-b765-2ec7ecdb297f", "name": "tangled-misty-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37366, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:01:36.631353+00:00", "ended_at": "2026-08-26T12:01:41.767010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8c7127e-580d-4cd4-8142-8d91100e8bd9", "name": "quaint-thorny-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56942, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 574, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:01:27.861920+00:00", "ended_at": "2026-08-26T12:01:31.042344+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "098dd574-c2c0-4571-b34d-1dcc31573416", "name": "cheerful-dutiful-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53150, "username": "coder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 489, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:01:20.251364+00:00", "ended_at": "2026-08-26T12:01:30.664395+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6dfba3b5-8c39-47d1-b46c-9f304d1f71b4", "name": "wistful-fickle-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56656, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:01:08.605577+00:00", "ended_at": "2026-08-26T12:01:23.839534+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "52121572-4f98-4823-8298-58a3627b5b1b", "name": "thrifty-craggy-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 41248, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 403, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:00:45.739721+00:00", "ended_at": "2026-08-26T12:00:49.548013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11b0ff87-8b24-47e5-a40d-afd9351fd351", "name": "vivid-silent-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53008, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:00:30.420565+00:00", "ended_at": "2026-08-26T12:00:36.330736+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fbafc228-9063-4de1-adfc-b3ee45cf1507", "name": "mighty-thorny-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46594, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 439, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:00:15.595895+00:00", "ended_at": "2026-08-26T12:00:21.238263+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "582610d4-e112-4d8d-b487-240d63d0b0cc", "name": "wry-smooth-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 51094, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 596, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T12:00:05.212598+00:00", "ended_at": "2026-08-26T12:00:10.428693+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "216dd79f-18bc-4b87-817d-49c17e4712ba", "name": "whispering-mighty-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60740, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:59:56.425542+00:00", "ended_at": "2026-08-26T11:59:59.433169+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3e0f6546-02bc-4714-8962-dbe9dd9368c9", "name": "cosmic-wistful-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37044, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 578, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:59:48.723944+00:00", "ended_at": "2026-08-26T11:59:54.525427+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8101c7b3-1820-4f8a-8aa1-2dbcb1edd4a4", "name": "keen-woven-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35414, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:59:30.161399+00:00", "ended_at": "2026-08-26T11:59:35.761457+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef00d923-8d5a-450a-8f25-bfa97294c879", "name": "cheerful-rambling-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46668, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:59:21.268175+00:00", "ended_at": "2026-08-26T11:59:26.842103+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ae2fa13-ef6b-42df-b6d1-bbf77f59b35c", "name": "frosty-regal-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44698, "username": "adminftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 865, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:59:05.004575+00:00", "ended_at": "2026-08-26T11:59:06.357144+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2169 }, { "id": "cd2f85f2-89b3-46b4-bdb7-064e58e4b937", "name": "courtly-electric-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60100, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:59:04.942994+00:00", "ended_at": "2026-08-26T11:59:09.672388+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd0b1838-1652-49dc-917c-fccd545fdc46", "name": "clever-inland-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 43558, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 650, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:59:02.492007+00:00", "ended_at": "2026-08-26T11:59:14.378072+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "d5bbf0ed-1fa7-4c81-ba73-32984a9fedfe", "name": "woven-rambling-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34262, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 661, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:58:33.856965+00:00", "ended_at": "2026-08-26T11:58:37.227463+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47114984-59ef-4eab-94f7-0ba206d94d83", "name": "jagged-bashful-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37142, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 772, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:58:22.323943+00:00", "ended_at": "2026-08-26T11:58:26.421248+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7ffca668-ec27-4b9b-81ae-18bd847ce43b", "name": "whispering-gilded-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59036, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 658, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:58:15.138773+00:00", "ended_at": "2026-08-26T11:58:24.460433+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "34410e58-f952-4bd2-b707-42e9972e3558", "name": "orderly-civil-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 34592, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:58:05.032017+00:00", "ended_at": "2026-08-26T11:58:19.367836+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "dbec48ca-ccf2-4b33-8448-9abeb9ee44e8", "name": "golden-gloomy-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 47888, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 563, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:57:45.540670+00:00", "ended_at": "2026-08-26T11:57:51.515450+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6a721df4-21c9-46e3-8935-b1dbd789ebfe", "name": "windswept-muted-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56838, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:57:28.958102+00:00", "ended_at": "2026-08-26T11:57:32.766235+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fafd0346-a92b-4a56-aa3a-e5094030a776", "name": "mossy-breezy-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53378, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 573, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:57:11.509724+00:00", "ended_at": "2026-08-26T11:57:15.217341+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "625c4537-99fc-4044-9937-06d760191d2b", "name": "drifting-sterling-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39086, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 552, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:56:59.179465+00:00", "ended_at": "2026-08-26T11:57:03.142668+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e9b2fcb-5290-4594-962a-6a23e3a9f66f", "name": "civil-granite-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48168, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 565, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:56:46.886749+00:00", "ended_at": "2026-08-26T11:56:50.517017+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4814c829-6084-4755-bdbe-5c85be1a44b7", "name": "early-fierce-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59940, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 629, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:56:41.493626+00:00", "ended_at": "2026-08-26T11:56:47.380442+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aeaec1c1-d1eb-45e5-b17f-16851b599125", "name": "knotted-merry-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 42458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 558, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:56:26.761907+00:00", "ended_at": "2026-08-26T11:56:30.824117+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "48a056fe-3af9-448d-877b-acd45465f3e1", "name": "grassy-faded-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54396, "username": "ftpuser1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:56:22.742282+00:00", "ended_at": "2026-08-26T11:56:33.671754+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a6c25b61-030a-4071-9e90-ee0ef194f6e3", "name": "bashful-lawful-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44498, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 860, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:56:22.503415+00:00", "ended_at": "2026-08-26T11:56:24.329787+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "81204ecb-c2b2-4628-b7f0-0e8c71cf14bb", "name": "austere-alpine-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59376, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:55:52.803719+00:00", "ended_at": "2026-08-26T11:55:56.086057+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba2bf7cd-7696-4533-b6eb-da300ba74520", "name": "airy-genial-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58010, "username": "jay", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 537, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:55:35.152127+00:00", "ended_at": "2026-08-26T11:55:47.454997+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "9fda9627-803f-499d-a1df-e6373660a6d6", "name": "murky-humble-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 48452, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:55:32.625996+00:00", "ended_at": "2026-08-26T11:55:35.506727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "66c1ebb1-7df5-465f-8a41-a8ec0931a661", "name": "fleeting-brave-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 38812, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 514, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:55:26.154359+00:00", "ended_at": "2026-08-26T11:55:37.003886+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "250bd101-c6b0-4c84-8889-e29d91ec3abd", "name": "hazel-restless-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 50184, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:55:13.289090+00:00", "ended_at": "2026-08-26T11:55:21.118787+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e0411f5d-d551-48d4-903c-548dfca91c93", "name": "creaky-arctic-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45344, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 605, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:54:52.175596+00:00", "ended_at": "2026-08-26T11:55:01.888276+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "2f58a71a-2f4b-4c25-b583-f83acf2c9152", "name": "twilight-tangled-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 59196, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:54:42.454381+00:00", "ended_at": "2026-08-26T11:54:46.923473+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c67a0514-b5a6-48e8-b71f-151ef940c2db", "name": "scarlet-amber-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 58482, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 397, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:54:23.049019+00:00", "ended_at": "2026-08-26T11:54:29.249891+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "94268478-809d-46a5-a852-c685e75f1d06", "name": "foggy-candid-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 39230, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 798, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:54:21.133041+00:00", "ended_at": "2026-08-26T11:54:30.702420+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "39975c09-2202-4199-8d42-81a67cb13a2e", "name": "mighty-supple-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60784, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 660, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:54:06.205377+00:00", "ended_at": "2026-08-26T11:54:20.762645+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "72340123-0afd-4c21-94bc-705c262a2b6a", "name": "western-blunt-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44304, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 873, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:53:43.692781+00:00", "ended_at": "2026-08-26T11:53:45.296546+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "c16392a3-f58c-4749-856f-5da4fa2d32c6", "name": "merry-courtly-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60412, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 492, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:53:42.900343+00:00", "ended_at": "2026-08-26T11:53:45.998502+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "637c0fbd-e0d9-417d-b17a-9333d9cd94cc", "name": "peaty-windswept-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40014, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 779, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:53:34.459647+00:00", "ended_at": "2026-08-26T11:53:44.141920+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "e221dd3e-46b7-42da-baa7-c2feccfa1a1c", "name": "murky-dusty-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53162, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:53:15.534806+00:00", "ended_at": "2026-08-26T11:53:19.055420+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90dda31b-d793-4663-8910-c649eee5d9da", "name": "gilded-dapper-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 56134, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 557, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:53:13.680106+00:00", "ended_at": "2026-08-26T11:53:25.562145+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e21b6994-764e-456d-b2e3-bef3c34ab180", "name": "nimble-candid-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55634, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 404, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:52:52.469811+00:00", "ended_at": "2026-08-26T11:53:03.142065+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "eb8b7721-47d4-45eb-8a02-0c0876dd8fc3", "name": "nameless-fickle-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37408, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:52:41.611681+00:00", "ended_at": "2026-08-26T11:52:53.877557+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "dd48fd0b-3487-491f-89c1-5de4a8b480e6", "name": "craggy-restless-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49080, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 437, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:52:10.504856+00:00", "ended_at": "2026-08-26T11:52:13.298172+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b90c9eb-1746-485d-850d-bb8cca019685", "name": "bitter-crimson-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35434, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 486, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:51:44.428637+00:00", "ended_at": "2026-08-26T11:51:55.292743+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "0410db00-8d91-40bc-aef1-63175691f0f4", "name": "alpine-cosmic-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 53960, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:51:27.135149+00:00", "ended_at": "2026-08-26T11:51:34.728513+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "70f4eec8-e3ff-49b0-be25-9a78c31594f1", "name": "gilded-gloomy-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 33534, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 673, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:51:10.299204+00:00", "ended_at": "2026-08-26T11:51:12.507066+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "752cd0da-2b55-47ec-847f-155887edd22d", "name": "fleeting-loyal-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44100, "username": "vmuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 884, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:51:06.242750+00:00", "ended_at": "2026-08-26T11:51:07.694793+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2136 }, { "id": "550a27a1-2eba-409e-a08e-2789c0cb4834", "name": "indigo-smoky-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 44264, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:51:00.930059+00:00", "ended_at": "2026-08-26T11:51:08.924896+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "511740a6-fc34-4dd5-9096-1b35bc08b3f5", "name": "spirited-snowy-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60772, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 535, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:50:41.142503+00:00", "ended_at": "2026-08-26T11:50:42.298509+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d80ebc81-8481-4065-8bf8-766296d36e73", "name": "frugal-sooty-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 52056, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 533, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:50:31.962153+00:00", "ended_at": "2026-08-26T11:50:40.868637+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d5f356b2-6a31-4891-ab1b-831bba85319c", "name": "rugged-subtle-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 45106, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 523, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:50:13.663564+00:00", "ended_at": "2026-08-26T11:50:15.028277+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8bacbdbc-ec44-4045-8c13-3058ffbcb9a1", "name": "opal-indigo-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46552, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:50:06.711817+00:00", "ended_at": "2026-08-26T11:50:13.687777+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "8cffd62f-dfd7-4c6e-b748-57cb8501da43", "name": "sullen-quiet-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54616, "username": "kafka", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 739, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:49:56.708029+00:00", "ended_at": "2026-08-26T11:50:04.825856+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "d7e53390-6316-4087-9fab-d6f875528779", "name": "buoyant-freckled-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 40850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1122, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:49:42.222966+00:00", "ended_at": "2026-08-26T11:49:43.352522+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d680827-3c24-49a3-ba97-9dedd58ba4de", "name": "ivory-brisk-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37198, "username": "calvin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 811, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:49:31.230791+00:00", "ended_at": "2026-08-26T11:49:45.294929+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "13b71b60-6fae-4a2a-9f2d-89dfb0e32348", "name": "wry-jolly-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 60282, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 667, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:49:11.007632+00:00", "ended_at": "2026-08-26T11:49:12.993519+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5a850ce7-b611-4688-b87f-c300e9073403", "name": "civil-grumpy-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 37606, "username": "qw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 909, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:48:57.490582+00:00", "ended_at": "2026-08-26T11:49:04.950018+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "28a979a1-076d-4b25-be0a-65ba1e793d8f", "name": "airy-calm-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46536, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 357, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:48:29.196852+00:00", "ended_at": "2026-08-26T11:48:29.616009+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ccf32f3-cbe9-4adf-8fe7-23943a53de80", "name": "woven-amiable-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43898, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 864, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:48:24.883383+00:00", "ended_at": "2026-08-26T11:48:26.523120+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2129 }, { "id": "84f9aede-b81a-4170-be06-8ba443a43ea7", "name": "dapper-golden-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 46062, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 532, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:48:17.522609+00:00", "ended_at": "2026-08-26T11:48:19.153250+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ffccd25c-f44c-4646-b1f9-bc346243c1f6", "name": "buoyant-wandering-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 55696, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 678, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:48:06.648778+00:00", "ended_at": "2026-08-26T11:48:15.695438+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0bedaaf2-d9c7-45a2-aa16-de92a0c47943", "name": "gleaming-ginger-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 49392, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 684, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:47:42.874237+00:00", "ended_at": "2026-08-26T11:47:49.292440+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "20b32771-c134-4910-b900-6a22d8e341d5", "name": "graceful-flinty-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 35126, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 683, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:47:33.034875+00:00", "ended_at": "2026-08-26T11:47:33.416014+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dc5e6ab6-9d1f-4f0a-b553-edde53f9122f", "name": "dusky-murky-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.239.124.249", "src_port": 54918, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 728, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T11:47:10.584190+00:00", "ended_at": "2026-08-26T11:47:29.591126+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "f7d9723b-5f85-4c76-b6e4-0d452896095e", "name": "wooded-amiable-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 36580, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:46:38.727558+00:00", "ended_at": "2026-08-26T11:46:40.939886+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "efda98f5-9861-49eb-9297-205440d44688", "name": "spirited-ashen-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43698, "username": "www", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 873, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:45:49.197397+00:00", "ended_at": "2026-08-26T11:45:50.712730+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2113 }, { "id": "2f739557-5a93-47b5-af38-f229af1575a9", "name": "northern-scarlet-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43498, "username": "tmpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 848, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:43:02.590725+00:00", "ended_at": "2026-08-26T11:43:04.236263+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2102 }, { "id": "5af68a09-f49c-452e-961c-a92307f8d3a6", "name": "scarlet-tranquil-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 43750, "username": "bill", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:42:02.270195+00:00", "ended_at": "2026-08-26T11:42:02.954243+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "c88a40df-a844-48ad-9d3a-19291ed8dc4e", "name": "salty-weathered-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43304, "username": "ec2-user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 847, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:40:23.703335+00:00", "ended_at": "2026-08-26T11:40:24.998012+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2092 }, { "id": "949d19fb-cc2f-454b-ae88-9ccf8f1e9195", "name": "cheerful-clever-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43102, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 862, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:37:44.723066+00:00", "ended_at": "2026-08-26T11:37:45.896430+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "297dd5dd-940c-4ec1-8e0e-cdc4a634979f", "name": "gleaming-vernal-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 52474, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 943, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:37:43.080918+00:00", "ended_at": "2026-08-26T11:37:43.851050+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "ea3cf1e8-49bb-47b6-9a86-22b48b7b6619", "name": "opal-primal-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 42904, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 870, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:34:56.688747+00:00", "ended_at": "2026-08-26T11:34:58.126427+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "34f80c5d-ecc3-4c4c-8732-2facfc5f8ece", "name": "gnarled-airy-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 42708, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 844, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:32:10.883641+00:00", "ended_at": "2026-08-26T11:32:11.680381+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2106 }, { "id": "fd738abe-884b-443c-bfd1-c3ea9b6fe0bf", "name": "snowy-forlorn-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 41352, "username": "sgp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 612, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:29:09.002582+00:00", "ended_at": "2026-08-26T11:29:10.410808+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "78c1fc94-4032-40a7-87bb-16f55d6b3ee5", "name": "jovial-earnest-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 42302, "username": "cgonzalez", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 871, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:26:37.896770+00:00", "ended_at": "2026-08-26T11:26:38.924393+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2051 }, { "id": "759c44d5-79aa-42ea-8cc4-e88cff721379", "name": "blithe-merry-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 48552, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:11:56.398052+00:00", "ended_at": "2026-08-26T11:11:57.985697+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "015fe738-86d0-4600-8fc1-ce1862f46dff", "name": "sullen-rugged-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 46886, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 585, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:07:25.095860+00:00", "ended_at": "2026-08-26T11:07:25.894192+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2291 }, { "id": "79db8206-616c-4adf-b4c2-57332374ccf1", "name": "pristine-freckled-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 33232, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 604, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:02:52.624467+00:00", "ended_at": "2026-08-26T11:02:53.299019+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2280 }, { "id": "0582e41e-a6e7-44ff-a77a-c270af0429d1", "name": "diligent-bold-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 40602, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 617, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:54:26.556075+00:00", "ended_at": "2026-08-26T10:54:27.999283+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2271 }, { "id": "01c754e0-3b90-438c-bada-aba809ae3f87", "name": "flinty-alpine-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 41778, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:50:02.070375+00:00", "ended_at": "2026-08-26T10:50:02.781088+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "be340f5a-e936-4685-a83a-b2a3bdd9f729", "name": "muted-leafy-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 44114, "username": "postmaster", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 606, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:45:29.561927+00:00", "ended_at": "2026-08-26T10:45:30.274291+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2196 }, { "id": "1dd6113f-076a-4ab2-ada1-a5ea698ab339", "name": "ginger-lucid-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 38334, "username": "tester1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 618, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:36:59.922949+00:00", "ended_at": "2026-08-26T10:37:01.241820+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2188 }, { "id": "33f53130-2244-448b-a647-4ef6efe00ae3", "name": "stoic-solar-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 45730, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:32:40.368925+00:00", "ended_at": "2026-08-26T10:32:42.587422+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2177 }, { "id": "100a3746-1310-476c-b1b4-94bcbf105d1f", "name": "hushed-honest-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 58910, "username": "arkserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 592, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:28:27.880116+00:00", "ended_at": "2026-08-26T10:28:29.479578+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "0020239e-8134-4b2a-a3ef-06753559c827", "name": "humble-dappled-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 51480, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 615, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:23:58.690166+00:00", "ended_at": "2026-08-26T10:24:00.018969+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "f3c633b0-6488-4717-a0f4-c399e02644ca", "name": "cheerful-inland-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 36286, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 616, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:19:39.338741+00:00", "ended_at": "2026-08-26T10:19:41.087847+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "eb8e6693-cde6-4fbb-8abb-03ae9efdf0ee", "name": "nameless-western-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 38584, "username": "eve", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 595, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:15:29.645308+00:00", "ended_at": "2026-08-26T10:15:31.154005+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2123 }, { "id": "621dfc2f-f9ed-4584-aa13-aa1c3a8cb412", "name": "thorny-lonesome-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 57234, "username": "contact", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 954, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:11:10.996306+00:00", "ended_at": "2026-08-26T10:11:12.616810+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2116 }, { "id": "b33232f9-4f46-4df0-a678-2c4b872f85c7", "name": "forlorn-idle-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 35348, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:06:36.905884+00:00", "ended_at": "2026-08-26T10:06:37.685000+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "f2ce7150-0e49-4b91-9027-0bd076c2fad5", "name": "ginger-glacial-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 35730, "username": "stepan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:02:17.929850+00:00", "ended_at": "2026-08-26T10:02:18.606257+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2103 }, { "id": "4a478ab2-ed8f-4c13-9f2a-e0e09322a336", "name": "amber-glacial-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 57736, "username": "fedora", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:53:36.137746+00:00", "ended_at": "2026-08-26T09:53:36.915615+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2092 }, { "id": "7ca21b8b-9d41-42f8-8fab-2e4edfa8f393", "name": "sincere-kindly-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 37646, "username": "student8", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:49:12.918639+00:00", "ended_at": "2026-08-26T09:49:13.578868+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2081 }, { "id": "6919b2d7-cef4-46de-b8eb-173179143281", "name": "forlorn-fabled-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 56138, "username": "abcdefg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 595, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:40:26.712522+00:00", "ended_at": "2026-08-26T09:40:27.439970+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2069 }, { "id": "f342cf91-46b6-4663-a6cd-92403fbcd750", "name": "amiable-silent-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 58350, "username": "cpg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:31:43.457741+00:00", "ended_at": "2026-08-26T09:31:44.119534+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "7c1f6698-5755-41d9-a772-0cda63287b4a", "name": "creaky-diligent-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 59822, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:18:23.297909+00:00", "ended_at": "2026-08-26T09:18:24.030659+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "6ec6a40d-09c8-460a-b08a-650911723df4", "name": "jaunty-brisk-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39600, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 164, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:48:26.521567+00:00", "ended_at": "2026-08-26T06:48:30.010242+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8fdfef39-d58a-4929-83fb-ab13a4b1c32c", "name": "stormy-tawny-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49774, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 164, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:48:17.965479+00:00", "ended_at": "2026-08-26T06:48:21.807026+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd6377cb-6e52-414f-90ba-677f9cef77ec", "name": "primal-grumpy-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60016, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 163, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:48:11.721000+00:00", "ended_at": "2026-08-26T06:48:17.678036+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80ab24e8-1c52-4cfa-a1ae-4061f521a37a", "name": "fierce-blazing-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49698, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 163, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:48:10.924693+00:00", "ended_at": "2026-08-26T06:48:15.746401+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a96ee299-983d-4a96-845d-5f441e14c734", "name": "burly-stormy-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59946, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 166, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:48:00.060936+00:00", "ended_at": "2026-08-26T06:48:03.003616+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2041fcb8-dfce-44c3-b6a7-15e39a8ce04c", "name": "gallant-stoic-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35650, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 167, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:59.442063+00:00", "ended_at": "2026-08-26T06:48:03.429695+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0deff63a-be22-4e89-a62a-a9ca0b60d086", "name": "brazen-opal-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35590, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 169, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:53.178166+00:00", "ended_at": "2026-08-26T06:47:58.539686+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "df51b444-0520-478a-943f-ac857d889691", "name": "austere-downy-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55176, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 168, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:51.147723+00:00", "ended_at": "2026-08-26T06:47:53.883537+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0cbc4748-e578-4e5e-ae52-2f26d80c09bf", "name": "thorny-twilight-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48870, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:43.590603+00:00", "ended_at": "2026-08-26T06:47:49.602152+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e7f028fb-d911-408f-b135-ad3ba4ac0643", "name": "gnarled-bold-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48856, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:36.803212+00:00", "ended_at": "2026-08-26T06:47:40.456165+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b5373f5a-80ec-46d2-a6c6-33387e5e4be7", "name": "blithe-drifting-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49760, "username": "super", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:35.373633+00:00", "ended_at": "2026-08-26T06:47:40.980777+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "20835cb7-da7e-4ff7-92a3-f5bdb17d247a", "name": "daring-curious-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:26.530942+00:00", "ended_at": "2026-08-26T06:47:31.531967+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f6228185-67b0-4938-94c3-1c96d564f328", "name": "dusty-burly-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49746, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:14.144254+00:00", "ended_at": "2026-08-26T06:47:19.295797+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d53b4a93-3f8d-4911-928b-68c1c3efbb75", "name": "tender-glassy-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52232, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:07.130840+00:00", "ended_at": "2026-08-26T06:47:09.804900+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8be9bdd6-cacd-4b38-9f51-5e591ff5b96c", "name": "umber-jaunty-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52200, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:02.371749+00:00", "ended_at": "2026-08-26T06:47:06.551721+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5c05de51-6b15-48cc-8249-018cd07b02a7", "name": "electric-honest-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35996, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:47:00.684406+00:00", "ended_at": "2026-08-26T06:47:05.996090+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1edd7c13-d9f4-4fd3-9a66-96651bf17757", "name": "kindly-golden-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35938, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:52.760008+00:00", "ended_at": "2026-08-26T06:46:56.944598+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fc651ed9-2e1f-43af-b805-cab7a9d7cbec", "name": "daring-jagged-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37756, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:47.060696+00:00", "ended_at": "2026-08-26T06:46:51.819164+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2d347eb-ce22-4336-a459-65ab3e22de5b", "name": "mindful-supple-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36434, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:44.361090+00:00", "ended_at": "2026-08-26T06:46:47.770389+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "40855d11-f814-44a7-ba9e-3b335f20f3c4", "name": "deft-serene-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36360, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:40.793071+00:00", "ended_at": "2026-08-26T06:46:44.353666+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1a5ad9d1-c38b-4879-a976-14258a74a607", "name": "placid-calm-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44616, "username": "demo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:37.815171+00:00", "ended_at": "2026-08-26T06:46:43.170390+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a430512f-b459-497e-9125-068563996148", "name": "lunar-humble-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58186, "username": "jay", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:25.431717+00:00", "ended_at": "2026-08-26T06:46:33.355876+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "a0190369-ccc7-4190-a9b0-5e0e59da4863", "name": "idle-quartz-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44668, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 176, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:25.129022+00:00", "ended_at": "2026-08-26T06:46:28.612249+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b51c8022-5d8d-4aad-8d78-09db71c3df6b", "name": "lofty-painted-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41006, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:22.494840+00:00", "ended_at": "2026-08-26T06:46:27.149019+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7724f35f-ca82-40f7-8983-678499f7e1c0", "name": "bashful-woven-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58126, "username": "ghost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 176, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:17.521664+00:00", "ended_at": "2026-08-26T06:46:23.025429+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e3ddf27a-180f-4b4d-bcbd-19efbd923440", "name": "lonesome-hushed-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40950, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:14.624011+00:00", "ended_at": "2026-08-26T06:46:18.188995+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6fc45d82-d198-4bfe-a284-4e9f4f177b79", "name": "prairie-sandy-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43760, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:46:03.203728+00:00", "ended_at": "2026-08-26T06:46:07.765071+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff0a98f6-8923-4978-9129-7de7505ec3fa", "name": "brazen-solar-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43732, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:56.281321+00:00", "ended_at": "2026-08-26T06:46:01.842139+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f9ae754f-6543-4b64-a67a-c7cdeedc30ff", "name": "crisp-dappled-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54832, "username": "kubernetes", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:50.767512+00:00", "ended_at": "2026-08-26T06:45:57.376050+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "f15ec24a-16a3-47cd-b7b2-341f03677326", "name": "grumpy-ivory-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54932, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:45.907359+00:00", "ended_at": "2026-08-26T06:45:51.291242+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9a6855f5-2d29-416a-9821-fdf13ba1cfaf", "name": "mindful-vigilant-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53172, "username": "init", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:36.090596+00:00", "ended_at": "2026-08-26T06:45:43.626817+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2fb5310b-8f69-4a83-98a5-caf88dfd3fba", "name": "nautical-tangled-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39388, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:29.892534+00:00", "ended_at": "2026-08-26T06:45:35.298749+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3867e40e-0d1a-4479-8337-9bae16140d82", "name": "mindful-velvet-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39330, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 181, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:27.642555+00:00", "ended_at": "2026-08-26T06:45:30.437128+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74c6824b-d0d4-4f19-82f0-6e8da70674c5", "name": "velvet-quiet-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53146, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:15.697480+00:00", "ended_at": "2026-08-26T06:45:21.652768+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8539d9ec-0df8-4887-8f27-f74f4088d6d5", "name": "vernal-hazy-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50898, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:14.947019+00:00", "ended_at": "2026-08-26T06:45:19.715203+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09bebbe7-0250-4958-886f-37c8e0fba0f1", "name": "stoic-lofty-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41750, "username": "test3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:14.380333+00:00", "ended_at": "2026-08-26T06:45:21.489442+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "75b6e413-cd60-4767-ab8e-571be79a82c5", "name": "spirited-humble-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50848, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:45:04.934377+00:00", "ended_at": "2026-08-26T06:45:09.675363+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ab15fb91-33cb-429a-941d-00602f8b735c", "name": "dapper-lunar-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41708, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:56.259852+00:00", "ended_at": "2026-08-26T06:45:01.428267+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5c220ba3-5fa1-424e-89fb-955036535494", "name": "rapid-sincere-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50062, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:55.155227+00:00", "ended_at": "2026-08-26T06:45:00.776012+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6c8ea05e-9245-4e6c-818e-21a07f615ff0", "name": "wandering-russet-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59422, "username": "edge", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:49.099538+00:00", "ended_at": "2026-08-26T06:44:52.467602+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "cd30b8fa-0b7b-4a77-bc06-0debc061116a", "name": "reedy-dutiful-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50000, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:48.415618+00:00", "ended_at": "2026-08-26T06:44:52.759757+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2c73c92c-5551-4298-ac49-9b219f33e5f9", "name": "polar-leafy-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "171.25.158.74", "src_port": 33096, "username": "crafty", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T06:44:45.650054+00:00", "ended_at": "2026-08-26T06:44:46.349201+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2038 }, { "id": "d4cd9b10-5b79-4ad2-9a2b-679d79679c94", "name": "canny-quiet-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59476, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:32.201295+00:00", "ended_at": "2026-08-26T06:44:35.041591+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b0b9821-0467-4ba9-85be-e9b1cc6d62ec", "name": "brave-salty-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56494, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:29.321449+00:00", "ended_at": "2026-08-26T06:44:33.689052+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0c1fe1c-7c72-499c-8906-3a44a39aff68", "name": "dewy-eager-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55092, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 176, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:19.788046+00:00", "ended_at": "2026-08-26T06:44:23.110104+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "21b4c77b-7ce5-4a1d-9fb5-3cbdf4068cb9", "name": "windswept-thorny-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54984, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:15.433269+00:00", "ended_at": "2026-08-26T06:44:19.613235+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "937901bb-22db-4bdc-8429-a9c8dbb4dd58", "name": "civil-drifting-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.144.28.166", "src_port": 57790, "username": "rustserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 676, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T06:44:12.693862+00:00", "ended_at": "2026-08-26T06:44:13.399402+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2044 }, { "id": "ab1b0f6e-bd5b-432f-ba1c-325fdda19447", "name": "subtle-gleaming-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39342, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:44:07.467077+00:00", "ended_at": "2026-08-26T06:44:11.514202+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e17e5573-e57c-49e6-b98d-2f541a452e75", "name": "vernal-dusty-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39302, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:58.904150+00:00", "ended_at": "2026-08-26T06:44:02.188828+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0be68a1e-6ae6-42f9-8e6b-e16815d3cf49", "name": "merry-faded-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48888, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 172, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:57.280103+00:00", "ended_at": "2026-08-26T06:43:59.886209+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "239104e9-24ba-4002-873c-f624f8c4cb91", "name": "twilight-serene-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48852, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:52.778206+00:00", "ended_at": "2026-08-26T06:43:55.787947+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34e82cf4-6bbe-4bd5-9bbe-92a8d7541c8c", "name": "sunlit-hearty-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56714, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:50.646916+00:00", "ended_at": "2026-08-26T06:43:55.520640+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "44aec49a-08fa-4960-b573-a55e276cd7a8", "name": "placid-prairie-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34132, "username": "core", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:49.484703+00:00", "ended_at": "2026-08-26T06:43:55.044522+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "d277d22a-535a-49f9-a8f8-31aa8b4ea9e0", "name": "burly-gentle-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56600, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:46.376196+00:00", "ended_at": "2026-08-26T06:43:51.635031+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "686da857-1119-48a8-863d-edc6be63705c", "name": "fierce-foggy-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45090, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 176, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:33.354043+00:00", "ended_at": "2026-08-26T06:43:36.038756+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "264031fc-0741-4c74-bb5d-59f03fea54e5", "name": "honest-fearless-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45026, "username": "zlm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:31.820260+00:00", "ended_at": "2026-08-26T06:43:37.218639+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "11d665bc-7502-441c-a9bf-337a6907d81f", "name": "bashful-restless-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47726, "username": "ivan", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:28.984590+00:00", "ended_at": "2026-08-26T06:43:34.250598+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "e0879117-1545-4bcb-ad93-536c3cba9568", "name": "woven-solemn-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47692, "username": "ftpuser1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:24.460537+00:00", "ended_at": "2026-08-26T06:43:29.656220+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8714f36d-0c25-4a52-8d79-756371e9e4ff", "name": "dapper-silent-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34526, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:11.934322+00:00", "ended_at": "2026-08-26T06:43:16.123931+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa56ef87-0f7a-4a11-94da-e95a7a561e2e", "name": "alpine-hardy-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34430, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:43:10.152969+00:00", "ended_at": "2026-08-26T06:43:15.654270+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d07bbf3-8d16-4ea4-add3-0deaf04d77f5", "name": "blunt-electric-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36770, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 193, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:55.060335+00:00", "ended_at": "2026-08-26T06:43:01.153652+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35634f23-75f1-4b45-a357-44846d9730ab", "name": "creaky-noble-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40870, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:50.679590+00:00", "ended_at": "2026-08-26T06:42:53.700154+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8601596-7ffb-498d-92db-4c8d378f5b28", "name": "steady-plucky-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43386, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:47.927620+00:00", "ended_at": "2026-08-26T06:42:52.161279+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "65851e4a-997b-4eab-98c4-c3a1a337b999", "name": "granite-leafy-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40860, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:43.437586+00:00", "ended_at": "2026-08-26T06:42:49.300705+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "553dba11-da6b-43ce-8f1e-82da79fb3157", "name": "bold-blazing-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43336, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:34.665597+00:00", "ended_at": "2026-08-26T06:42:39.264659+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5eb59c3c-3a63-4699-b9ec-91287ea407e2", "name": "brave-crisp-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54196, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:22.941444+00:00", "ended_at": "2026-08-26T06:42:26.128503+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4537840-975b-45c0-89a5-24daeb19e122", "name": "keen-northern-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38186, "username": "bot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:19.389738+00:00", "ended_at": "2026-08-26T06:42:22.791058+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d381e9fa-87ad-4f3b-8a0f-e8d82155cbb2", "name": "regal-flinty-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44858, "username": "vyos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:16.140255+00:00", "ended_at": "2026-08-26T06:42:22.518126+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "52b6fa45-e79c-4a6f-8e8a-f912be1b24dd", "name": "civil-bronzed-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44912, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:42:12.194536+00:00", "ended_at": "2026-08-26T06:42:14.816262+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7b78a39f-f0c3-41d0-bfd7-8cefa50d5c4b", "name": "western-hearty-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51512, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:59.260170+00:00", "ended_at": "2026-08-26T06:42:03.106635+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f7225710-6012-4769-a074-8e8eed3110b1", "name": "vaulted-subtle-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51464, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:50.544728+00:00", "ended_at": "2026-08-26T06:41:55.571184+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8347bb93-352a-4472-b41f-675bf9d714fc", "name": "polar-lawful-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36292, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:44.839594+00:00", "ended_at": "2026-08-26T06:41:50.421484+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff39adc0-0b2c-4bd2-8750-31b86ec33302", "name": "thrifty-rugged-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36196, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:42.990167+00:00", "ended_at": "2026-08-26T06:41:48.695320+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d93a56b-9271-4c54-9e91-4533b940aab7", "name": "thrifty-feathered-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58432, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:39.638099+00:00", "ended_at": "2026-08-26T06:41:43.690236+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "71a7a0e1-728c-4030-8d70-f1399f6ed914", "name": "ancient-downy-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39500, "username": "test1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:37.426410+00:00", "ended_at": "2026-08-26T06:41:40.447047+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "1412eb42-f7b2-45d6-b298-b660929e30a0", "name": "plush-burly-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36758, "username": "gg", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:36.620244+00:00", "ended_at": "2026-08-26T06:41:42.754645+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "465a0933-0c0f-4bf1-9ce4-4f4acaa425dd", "name": "crisp-clever-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39428, "username": "mcserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:34.687482+00:00", "ended_at": "2026-08-26T06:41:42.874652+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "98778d98-b926-4293-9504-f829ba3ca255", "name": "graceful-dapper-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43842, "username": "recorder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:14.026442+00:00", "ended_at": "2026-08-26T06:41:20.538906+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "4490f5dd-12b5-4a5f-87a6-bafa860fd714", "name": "marbled-ginger-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36682, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:12.925505+00:00", "ended_at": "2026-08-26T06:41:17.301565+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "925297c1-c5d3-48bb-888e-8352fc5b9715", "name": "genial-barren-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59764, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 220, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:41:08.386283+00:00", "ended_at": "2026-08-26T06:41:11.660460+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11393888-16a8-46f6-9c26-1a459bdd7434", "name": "coastal-ivory-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43916, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:58.695657+00:00", "ended_at": "2026-08-26T06:41:02.710422+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "18dad7f0-ea64-451d-a640-3e7d4f113e55", "name": "sooty-amiable-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57498, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:50.748795+00:00", "ended_at": "2026-08-26T06:40:56.748183+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a13d8629-4a56-4180-b4b6-0f2384dff8c5", "name": "coral-pristine-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57450, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:47.762360+00:00", "ended_at": "2026-08-26T06:40:52.686676+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5569b4c4-a528-4fa2-9586-58f427656128", "name": "twilight-cheerful-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39566, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:41.036760+00:00", "ended_at": "2026-08-26T06:40:44.639020+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd8593b4-9d83-4f45-b646-bb77c575bdc8", "name": "fierce-bronzed-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39468, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:35.752593+00:00", "ended_at": "2026-08-26T06:40:40.023884+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4011f16d-9aa3-4ed6-98db-fc84f94980f8", "name": "amiable-solemn-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55172, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:26.933990+00:00", "ended_at": "2026-08-26T06:40:32.623500+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb36986f-dfb1-4214-a8c3-4d6ef029b193", "name": "barren-stormy-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55144, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:26.757624+00:00", "ended_at": "2026-08-26T06:40:30.650736+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a31916b-03b4-4e21-b061-6d50bae099db", "name": "seaward-bronzed-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38878, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:11.570280+00:00", "ended_at": "2026-08-26T06:40:17.585410+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2dbd27cb-830d-49b1-8e21-0ea22e4f2384", "name": "hollow-pleasant-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45730, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:09.600375+00:00", "ended_at": "2026-08-26T06:40:13.263287+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06ffd699-38cb-4b3c-9594-8791be1f6822", "name": "nautical-valiant-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45646, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:08.732753+00:00", "ended_at": "2026-08-26T06:40:13.242408+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "566457f6-191d-4312-afd6-ca9a399e1eb7", "name": "blithe-grassy-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50430, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:40:04.344754+00:00", "ended_at": "2026-08-26T06:40:07.930030+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b01baed-c81c-46fb-80dd-e46879b383df", "name": "dappled-tender-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50348, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:55.927108+00:00", "ended_at": "2026-08-26T06:39:59.892004+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b062a8f3-80a0-4ffc-9ce2-63de804fd61e", "name": "amber-graceful-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56260, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:47.794143+00:00", "ended_at": "2026-08-26T06:39:52.482858+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4e4c3bd5-86e8-4c82-b724-e1a9d59351a5", "name": "sunlit-sooty-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55378, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:45.837836+00:00", "ended_at": "2026-08-26T06:39:49.758160+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e21cc26-bb33-4b77-92f5-42052f3a274f", "name": "lawful-quartz-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56210, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:44.218065+00:00", "ended_at": "2026-08-26T06:39:48.362158+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4852ad0c-acc2-4d3e-89db-9783cf4936b1", "name": "mindful-diligent-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50228, "username": "jack", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:40.362067+00:00", "ended_at": "2026-08-26T06:39:46.115026+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3f486182-76fc-4a01-a171-9e2ac9fc552d", "name": "gritty-chilly-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50288, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:35.905400+00:00", "ended_at": "2026-08-26T06:39:41.737458+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "88d0b6e9-4403-4395-8c43-30847efd239b", "name": "brazen-lawful-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43082, "username": "angel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:16.439688+00:00", "ended_at": "2026-08-26T06:39:22.754119+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "ac346207-be52-4921-9869-35d044a0be87", "name": "quartz-plush-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33586, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:12.908496+00:00", "ended_at": "2026-08-26T06:39:16.643846+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "24fa9f3d-763b-41c8-9f38-ec7f87a881d1", "name": "arctic-grassy-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43136, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:09.431034+00:00", "ended_at": "2026-08-26T06:39:13.751160+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d660bd08-bea0-4bf1-a858-f2faf3e1b95f", "name": "burly-serene-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48002, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:39:01.066296+00:00", "ended_at": "2026-08-26T06:39:03.758768+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf192b9b-a1b5-453d-a27a-086363283819", "name": "mossy-hazel-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40130, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:51.539049+00:00", "ended_at": "2026-08-26T06:38:55.114402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "886b9a04-8195-4d99-9dba-133610739a24", "name": "civil-velvet-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54912, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:45.618393+00:00", "ended_at": "2026-08-26T06:38:48.805292+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69d2041b-5557-4a0f-91c6-d7b31afdbde0", "name": "diligent-opal-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40108, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:44.956425+00:00", "ended_at": "2026-08-26T06:38:49.366129+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e3230e4-2903-49d9-bbbe-e2d8343357a7", "name": "earnest-merry-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54850, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:38.681163+00:00", "ended_at": "2026-08-26T06:38:44.235115+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95006cd9-dc78-4721-8fe1-4f34d66396e4", "name": "lanky-orderly-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50992, "username": "amine", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:32.050711+00:00", "ended_at": "2026-08-26T06:38:39.999442+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "5960705f-f3c7-49b0-b011-decdc7b54593", "name": "downy-austere-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51082, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:29.850743+00:00", "ended_at": "2026-08-26T06:38:32.840490+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69a8aa79-99f6-40df-ac03-5c6b6ac6ce4d", "name": "umber-forlorn-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48684, "username": "main", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:24.669945+00:00", "ended_at": "2026-08-26T06:38:33.266048+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "5ca93f6a-a5b7-420f-ac56-15c4afaa5809", "name": "humble-vaulted-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48622, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:12.536041+00:00", "ended_at": "2026-08-26T06:38:17.233356+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45826ab7-a996-45ff-8883-b0b89ab79d8b", "name": "curious-blunt-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36276, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:09.295635+00:00", "ended_at": "2026-08-26T06:38:12.667495+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74a5b1e6-aded-4222-a0fc-3a03ace39f28", "name": "hazel-early-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47962, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:07.765313+00:00", "ended_at": "2026-08-26T06:38:13.183128+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69d5933b-f9ec-4977-8622-f8ecf7857255", "name": "meadow-deft-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47906, "username": "a", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:38:03.250060+00:00", "ended_at": "2026-08-26T06:38:08.742649+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7ae115b1-5193-4aea-86a0-286afacebd45", "name": "rustic-crimson-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54940, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:53.160775+00:00", "ended_at": "2026-08-26T06:37:57.716433+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0adc04a2-7ce8-43fc-be7c-228fd695b1d0", "name": "gentle-granite-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54828, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:49.604745+00:00", "ended_at": "2026-08-26T06:37:53.035324+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51926c9b-14db-4965-8651-b034d9f0c373", "name": "jagged-ivory-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50312, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:39.889415+00:00", "ended_at": "2026-08-26T06:37:45.406390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9100214b-9a1b-4eb8-b8cf-cac89ba575f9", "name": "tender-loyal-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50378, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:36.894081+00:00", "ended_at": "2026-08-26T06:37:40.779765+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c6fcb8fd-ae28-4d52-b2a6-6c54c52f1df6", "name": "dusky-fearless-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42540, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:27.280357+00:00", "ended_at": "2026-08-26T06:37:30.636052+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4f638cbf-85be-4b75-b8a4-c8308256a4d3", "name": "marine-opal-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42486, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:22.529959+00:00", "ended_at": "2026-08-26T06:37:28.549845+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4d47209c-e8d6-42d9-89b3-00022961aad9", "name": "alpine-quaint-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50682, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:17.454582+00:00", "ended_at": "2026-08-26T06:37:23.673481+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "018b899d-f1b9-477b-8180-0314b3afa1f2", "name": "crystal-nimble-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44844, "username": "fred", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:16.948238+00:00", "ended_at": "2026-08-26T06:37:22.707337+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f7da6d18-5a55-4dee-886b-f2bcfdd97e0c", "name": "sunlit-barren-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44818, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:08.680047+00:00", "ended_at": "2026-08-26T06:37:13.422141+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3158d6aa-aa2b-4cab-aef4-d7a50ef4318a", "name": "thrifty-vigilant-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51432, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:37:01.822511+00:00", "ended_at": "2026-08-26T06:37:06.934883+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8304ff63-b88f-4048-afdf-f6abd6446e3d", "name": "curious-fearless-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46870, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:53.572446+00:00", "ended_at": "2026-08-26T06:36:57.059030+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ea7fd13-89e3-4de8-a921-1b5cf0a539b6", "name": "icy-flinty-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51334, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:51.170258+00:00", "ended_at": "2026-08-26T06:36:54.837585+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "54e96d00-a78d-4753-9aa8-62f4bf43c592", "name": "leafy-canny-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46808, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:45.753498+00:00", "ended_at": "2026-08-26T06:36:49.406577+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42b5b150-07f6-4118-9301-7a8ed2468dc7", "name": "gnarled-weathered-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37130, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:37.885406+00:00", "ended_at": "2026-08-26T06:36:42.168042+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09805db8-e131-4cbb-b295-3c819d58b0db", "name": "loyal-fierce-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37054, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:34.166421+00:00", "ended_at": "2026-08-26T06:36:38.413922+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "82bdba9f-b9ce-45bb-9105-5c61b9db4336", "name": "earnest-gnarled-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53316, "username": "work", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:28.232194+00:00", "ended_at": "2026-08-26T06:36:32.797300+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0fbb8e4-8885-497e-a5d5-c9e6519074b4", "name": "hearty-regal-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 32798, "username": "martin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:20.044628+00:00", "ended_at": "2026-08-26T06:36:26.430173+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d6c33bfa-3050-4f06-bf1a-ca21abd387c1", "name": "blithe-civil-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43340, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:19.646215+00:00", "ended_at": "2026-08-26T06:36:23.474354+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e00c802d-3155-4397-ab2d-081871cf8454", "name": "gritty-reedy-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43236, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:16.137464+00:00", "ended_at": "2026-08-26T06:36:19.922365+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "40951bd3-2c48-47ff-ba49-4d0b2a2cd89b", "name": "vaulted-gentle-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60952, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:36:06.389948+00:00", "ended_at": "2026-08-26T06:36:12.044594+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "813cb636-b241-47c0-80ed-ac86ee621720", "name": "inland-placid-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44490, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:59.448065+00:00", "ended_at": "2026-08-26T06:36:03.982638+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49429fc4-077c-4d11-8102-ef7497ff4751", "name": "crimson-tawny-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44362, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:51.736945+00:00", "ended_at": "2026-08-26T06:35:55.231383+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f1fda1bd-75c0-41a2-8ec5-9ec385e4d33c", "name": "meadow-supple-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50496, "username": "hummingbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:46.992454+00:00", "ended_at": "2026-08-26T06:35:54.220356+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "c6e2175d-42eb-4d58-b7d3-eca7190b86b4", "name": "golden-indigo-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40900, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:46.267796+00:00", "ended_at": "2026-08-26T06:35:52.209361+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f27bcf9f-e2ed-43ed-bb3e-3628f362486a", "name": "thawing-mighty-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44980, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:42.264002+00:00", "ended_at": "2026-08-26T06:35:46.781374+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7c892f62-2a18-44ef-b0be-e395c693dc1e", "name": "woven-slender-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44918, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:39.240739+00:00", "ended_at": "2026-08-26T06:35:44.110998+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d70ae6c-68d0-4477-9ed5-671d591601db", "name": "murky-mellow-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50468, "username": "system", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 220, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:35.673818+00:00", "ended_at": "2026-08-26T06:35:40.380612+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4acb443a-cdb2-4d54-ad95-004e3087dba1", "name": "ginger-polar-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34688, "username": "centreon", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:24.836644+00:00", "ended_at": "2026-08-26T06:35:31.351926+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "cbab57ff-5154-46b4-b89b-3dcedaab9d40", "name": "valiant-vivid-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50138, "username": "service", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:15.212726+00:00", "ended_at": "2026-08-26T06:35:21.513150+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "86dc874b-287d-442a-8106-ad85445c810d", "name": "patient-solemn-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34596, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:10.384085+00:00", "ended_at": "2026-08-26T06:35:14.151609+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf705ae2-311b-438a-9a66-894fc7165b61", "name": "sandy-kindly-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50092, "username": "gns3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:09.598529+00:00", "ended_at": "2026-08-26T06:35:15.257224+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "97dd9a9d-b448-4482-9f55-4a3c9b587aec", "name": "jolly-valiant-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51806, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:35:00.806878+00:00", "ended_at": "2026-08-26T06:35:06.648174+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03018761-fb10-47c3-9305-fb5d0071b6aa", "name": "muted-hazy-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46300, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:56.943472+00:00", "ended_at": "2026-08-26T06:35:01.694278+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6dee5b8a-6282-4ea1-854c-85d6c5746015", "name": "sterling-loyal-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46224, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:44.614725+00:00", "ended_at": "2026-08-26T06:34:49.431504+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2dfcdffe-a5c3-4d30-b98f-75c368473e0a", "name": "gentle-rambling-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33950, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:39.939592+00:00", "ended_at": "2026-08-26T06:34:42.549955+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2e8cca1-82ee-46e5-be08-ebe3bebc7026", "name": "quaint-hazy-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33894, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:39.346003+00:00", "ended_at": "2026-08-26T06:34:42.953526+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92a0fa3e-89db-4878-aca1-bb1692b22043", "name": "chilly-fearless-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56354, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:36.186336+00:00", "ended_at": "2026-08-26T06:34:40.691734+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5c485a6-68a2-4a8b-a7a8-f4aef167d4f9", "name": "emerald-primal-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56328, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:26.093817+00:00", "ended_at": "2026-08-26T06:34:29.732512+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9043c1b6-ae5c-43bf-9b57-f70045c22a51", "name": "noble-blazing-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60330, "username": "jakob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:16.595911+00:00", "ended_at": "2026-08-26T06:34:23.524363+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "7084def8-c726-4939-9bbb-772badb64b12", "name": "ivory-grassy-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36630, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:14.967657+00:00", "ended_at": "2026-08-26T06:34:19.779349+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "234e5652-24a4-4d7f-aba4-f0d80b141348", "name": "alpine-mottled-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60384, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:09.489129+00:00", "ended_at": "2026-08-26T06:34:12.526004+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dab62f05-8d69-423c-bfc8-c95b8a8072e8", "name": "windswept-hardy-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41340, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:34:04.873492+00:00", "ended_at": "2026-08-26T06:34:10.068860+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7aa3d37b-c5f1-4fcb-b154-cb7446114c3e", "name": "clever-hazy-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41284, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:58.511118+00:00", "ended_at": "2026-08-26T06:34:04.196046+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "053a7aed-c9e3-415a-80fb-fac0865cd93a", "name": "quartz-ivory-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42000, "username": "ranga", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:58.493551+00:00", "ended_at": "2026-08-26T06:34:03.599686+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "bb5e3756-9e57-48be-9a2b-ce58628804c7", "name": "thawing-fabled-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45140, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:41.879233+00:00", "ended_at": "2026-08-26T06:33:46.568838+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73f4bc89-c9ba-4d81-ad48-bfea4378bf88", "name": "icy-obsidian-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45242, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:37.511194+00:00", "ended_at": "2026-08-26T06:33:45.578504+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "395f01c9-d946-4e9c-9003-851760328011", "name": "thorny-mindful-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54318, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:36.544964+00:00", "ended_at": "2026-08-26T06:33:41.986655+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3aaa3a8f-adb2-4a12-8bdd-f7883dd54dfa", "name": "foggy-mottled-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54238, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:24.162133+00:00", "ended_at": "2026-08-26T06:33:26.962755+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5741300d-568b-4ceb-8e2f-d065281f6dcf", "name": "early-glacial-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38152, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:20.111711+00:00", "ended_at": "2026-08-26T06:33:27.044009+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "39584d21-1c4b-4389-a8b3-a8b5c14c5cd2", "name": "dapper-rapid-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45156, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:15.817932+00:00", "ended_at": "2026-08-26T06:33:20.110472+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "260ce9ef-a203-4e4b-9ece-2afaf172b88c", "name": "sandy-tangled-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57416, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:11.617270+00:00", "ended_at": "2026-08-26T06:33:18.892462+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "79125f51-3856-40a0-a23e-9d543574a7c6", "name": "blazing-coastal-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38236, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:33:10.130879+00:00", "ended_at": "2026-08-26T06:33:12.968272+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0242f805-a9ac-4ac1-a4af-9428377e5ef9", "name": "polar-cobalt-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57378, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:54.438404+00:00", "ended_at": "2026-08-26T06:32:59.208800+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "256aa51b-ada7-40ea-98c5-bfa91bd502b6", "name": "fleeting-stormy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54048, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:51.883940+00:00", "ended_at": "2026-08-26T06:32:55.898441+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b7c831b-64f2-4ce4-b887-ff6059c61d3b", "name": "solemn-primal-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40622, "username": "hu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:51.236718+00:00", "ended_at": "2026-08-26T06:32:57.813137+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "68cf58cc-dd3c-4e69-a06f-fb6bf439c288", "name": "verdant-pristine-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40706, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:50.561720+00:00", "ended_at": "2026-08-26T06:32:55.165000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bcbcafb8-aaf4-4afa-8029-d90e0c19d51f", "name": "leafy-freckled-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56056, "username": "botuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:31.619096+00:00", "ended_at": "2026-08-26T06:32:38.784578+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "3be68833-4f93-448f-8419-dfaa0eae0267", "name": "salty-buoyant-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55004, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:29.095515+00:00", "ended_at": "2026-08-26T06:32:33.291143+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f16b7652-5505-4f2c-8364-2ab0ad373708", "name": "frosty-quartz-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55046, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:28.932871+00:00", "ended_at": "2026-08-26T06:32:32.884431+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34ce6ba2-036f-4b3d-aa16-267c934353e0", "name": "crisp-arctic-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56002, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:16.673691+00:00", "ended_at": "2026-08-26T06:32:21.583347+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "48062a48-2c53-418a-b36d-b769097ded53", "name": "scarlet-inland-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44060, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:09.746894+00:00", "ended_at": "2026-08-26T06:32:13.368515+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b661e265-2db1-4c67-903c-57ce72112b33", "name": "proud-graceful-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56442, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:32:07.024794+00:00", "ended_at": "2026-08-26T06:32:10.516303+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ad08530-bd97-42e9-a27d-dbf2041a27ff", "name": "amber-vernal-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43996, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:56.067928+00:00", "ended_at": "2026-08-26T06:31:58.924147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "79025bf8-83ff-45b1-b7e6-b1c678a39bad", "name": "pleasant-painted-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52994, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:51.842968+00:00", "ended_at": "2026-08-26T06:31:54.633490+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f2d35f3-4d65-458e-96ec-80ffe69e0e8d", "name": "curious-marbled-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35964, "username": "labuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:49.159551+00:00", "ended_at": "2026-08-26T06:31:55.092750+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "a113de99-5c7b-40b1-a941-70aec167e2e1", "name": "northern-downy-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53040, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:44.783638+00:00", "ended_at": "2026-08-26T06:31:47.744153+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "101b853c-1368-4f36-bfcd-a909a0354678", "name": "boreal-orderly-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54660, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:31.171992+00:00", "ended_at": "2026-08-26T06:31:33.868921+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e6fde4b7-9f20-43a7-81bc-fc85b67bb35a", "name": "noble-bronzed-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54622, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:27.958846+00:00", "ended_at": "2026-08-26T06:31:31.060150+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3e0faa5-4644-4d55-b213-3b64d6852bdc", "name": "hearty-marbled-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39118, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:23.152567+00:00", "ended_at": "2026-08-26T06:31:27.315058+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "583be4a2-4e44-4fc9-abb8-056375bdbc2d", "name": "blunt-hardy-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39076, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:16.210219+00:00", "ended_at": "2026-08-26T06:31:18.956369+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0104703d-bc57-4f77-8611-0099fca1bd75", "name": "stoic-sturdy-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42600, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:06.893378+00:00", "ended_at": "2026-08-26T06:31:10.620206+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd426769-d2eb-4fab-bdf9-72278f609337", "name": "emerald-thrifty-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40514, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:31:01.187244+00:00", "ended_at": "2026-08-26T06:31:07.016673+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a2f0ef8f-a241-4f3a-bcf4-b14244e7de4b", "name": "foggy-sullen-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38814, "username": "agent", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:57.988402+00:00", "ended_at": "2026-08-26T06:31:06.000029+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "2f74e8df-87d9-4aef-b6ea-9b45fa0c98bc", "name": "seaward-grumpy-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40464, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:54.910348+00:00", "ended_at": "2026-08-26T06:30:59.464740+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "947d8253-6b03-4e17-a5bf-bc89c99860fc", "name": "murky-civil-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38866, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:50.779949+00:00", "ended_at": "2026-08-26T06:30:55.122735+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e419b9a-8355-42cc-826d-bb81ca64bf90", "name": "tangled-icy-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47480, "username": "vpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:42.979092+00:00", "ended_at": "2026-08-26T06:30:50.485504+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "681c3ade-21f5-41f8-b375-cff89860f39a", "name": "wiry-slender-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59550, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:36.452068+00:00", "ended_at": "2026-08-26T06:30:40.416694+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "84e36f81-97e9-4788-8496-de71f18b61fa", "name": "meadow-marine-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59448, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:33.969093+00:00", "ended_at": "2026-08-26T06:30:39.405209+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4a8488e7-022f-4625-86f8-a7643e73fe93", "name": "ivory-mellow-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52740, "username": "admin123", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:31.591945+00:00", "ended_at": "2026-08-26T06:30:37.850683+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "aec9ffa9-ca7a-4a64-8018-3d6107f4a730", "name": "hollow-distant-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44010, "username": "marcu1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:20.273920+00:00", "ended_at": "2026-08-26T06:30:27.160242+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9103be47-5060-4d07-b6af-18391eae13e1", "name": "sterling-plucky-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52800, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:18.114384+00:00", "ended_at": "2026-08-26T06:30:24.131225+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35e1b886-73df-47e7-a7a6-fa13e919f04c", "name": "feathered-emerald-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58350, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:05.354921+00:00", "ended_at": "2026-08-26T06:30:09.092168+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1949f89f-b4aa-4914-954d-5831b5d53504", "name": "tawny-boreal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43960, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:30:02.317567+00:00", "ended_at": "2026-08-26T06:30:05.747694+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "63980450-d4bc-406d-9deb-519454beceed", "name": "noble-grumpy-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58298, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:55.515384+00:00", "ended_at": "2026-08-26T06:30:01.605095+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ba6df9e-89b5-40a9-8e32-cdcaaab54c72", "name": "flinty-rustic-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59646, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:46.545479+00:00", "ended_at": "2026-08-26T06:29:51.575147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2580390a-2596-490a-b550-fb5f697c62ac", "name": "knotted-brave-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46566, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:46.450564+00:00", "ended_at": "2026-08-26T06:29:50.554545+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7f4bc258-69a5-4f22-939b-2a0213b250c7", "name": "amber-silent-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59528, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:31.473878+00:00", "ended_at": "2026-08-26T06:29:35.348789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "22570a6c-7faa-4534-a668-2b6b17e64d40", "name": "fickle-distant-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42930, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:29.810476+00:00", "ended_at": "2026-08-26T06:29:33.146402+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ecfe9a47-5206-4c89-a333-0c6a1fccd302", "name": "scarlet-twilight-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42866, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:29.747836+00:00", "ended_at": "2026-08-26T06:29:33.154652+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80f1eac8-adf6-4436-b453-ae6519a15d44", "name": "dappled-barren-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56126, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:17.559394+00:00", "ended_at": "2026-08-26T06:29:20.553388+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f5e639a-9e41-4b31-b65c-a8e3c8216a31", "name": "dutiful-cosmic-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56068, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:13.852991+00:00", "ended_at": "2026-08-26T06:29:16.849069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "717fcc33-227b-48d5-93d5-b5d85eff8d12", "name": "lucid-murky-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38320, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:29:03.951186+00:00", "ended_at": "2026-08-26T06:29:09.731714+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aadfd449-083c-4857-b8b5-cf9a24732d4e", "name": "gallant-fringed-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48970, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:58.583152+00:00", "ended_at": "2026-08-26T06:29:01.654552+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3292745-c44f-4d8f-8e92-f4b7aceec708", "name": "quaint-valiant-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48920, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:55.504278+00:00", "ended_at": "2026-08-26T06:29:01.376490+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fee77fdb-86ea-4fcd-9069-3486e754566f", "name": "coral-golden-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37186, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:48.898524+00:00", "ended_at": "2026-08-26T06:28:52.978103+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2feaf874-9b6c-492d-b1e0-e108544c7e75", "name": "thawing-vernal-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37138, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:48.801194+00:00", "ended_at": "2026-08-26T06:28:52.115570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2216473-6a3d-4782-bfe2-730025d3bd95", "name": "golden-jaunty-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57546, "username": "csgo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:44.382049+00:00", "ended_at": "2026-08-26T06:28:50.931480+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "d14f9ef4-3407-4a4b-ad5f-b81c161e6dff", "name": "dapper-lucid-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57622, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:39.524009+00:00", "ended_at": "2026-08-26T06:28:44.930754+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e6b4fc94-5dfd-4d85-ba7a-b5f4d7141bdc", "name": "russet-dusky-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59514, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:28.758585+00:00", "ended_at": "2026-08-26T06:28:32.678121+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bc01533-e476-452f-961a-11ac584c7fe9", "name": "dewy-ginger-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42024, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:19.333884+00:00", "ended_at": "2026-08-26T06:28:22.268423+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "82d80f16-1f56-438f-84b2-85d5d26f0d2b", "name": "noble-windswept-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41974, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:11.592109+00:00", "ended_at": "2026-08-26T06:28:15.764645+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "284a8797-e844-4f3e-8a8e-68612b11dc65", "name": "opal-burly-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39936, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 339, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:09.807095+00:00", "ended_at": "2026-08-26T06:28:14.114227+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9b684a5-6816-4dda-9c52-83c11b2160dc", "name": "oaken-indigo-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39906, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:02.203847+00:00", "ended_at": "2026-08-26T06:28:08.197348+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "361078a5-9995-4eeb-b74d-2b3c4d3db53f", "name": "forlorn-daring-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57480, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:28:00.486547+00:00", "ended_at": "2026-08-26T06:28:04.973671+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0fc33f2-4c13-42bb-baa5-fa7622ced64e", "name": "hazy-regal-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37054, "username": "test2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:55.607441+00:00", "ended_at": "2026-08-26T06:28:02.826014+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "73c70120-79ff-426b-a6f2-7f8349959e64", "name": "proud-hidden-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37124, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:53.100832+00:00", "ended_at": "2026-08-26T06:27:57.808755+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b604921-a063-4467-9e77-d30df9c607d6", "name": "hidden-prairie-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43898, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:46.689677+00:00", "ended_at": "2026-08-26T06:27:54.670863+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "fc2eea0f-2e53-44cc-8b86-9caed6756973", "name": "mossy-amiable-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43972, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:34.545661+00:00", "ended_at": "2026-08-26T06:27:38.967590+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5859b0da-81fc-4dd4-95c3-43b9dbffe805", "name": "serene-chilly-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43014, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:28.422819+00:00", "ended_at": "2026-08-26T06:27:34.257590+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2904a879-c71d-4948-ab4a-d0e1a564fe42", "name": "lonesome-blunt-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53910, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:20.957708+00:00", "ended_at": "2026-08-26T06:27:29.776711+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1672 }, { "id": "44021494-76e3-49d2-a237-6f4c89dfbde2", "name": "genial-bronzed-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53954, "username": "dani", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:20.654575+00:00", "ended_at": "2026-08-26T06:27:25.431590+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "219f1177-b35e-47c3-b5a2-52bbb5a3e09e", "name": "autumn-mellow-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37062, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:14.125227+00:00", "ended_at": "2026-08-26T06:27:19.433745+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa1a8d7b-ddce-440b-b460-cf4ad5307c23", "name": "hidden-merry-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52596, "username": "customer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:27:04.292073+00:00", "ended_at": "2026-08-26T06:27:11.028449+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "c7e00f26-05bf-4616-a361-4ea906707886", "name": "sunlit-golden-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52522, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:51.450406+00:00", "ended_at": "2026-08-26T06:26:54.813822+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "84483166-8e52-40c2-aa23-588d1d756e49", "name": "diligent-calm-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50262, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:47.222493+00:00", "ended_at": "2026-08-26T06:26:52.436741+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0ecbae2-cdd8-4aed-88d0-6aa831ae9747", "name": "vernal-blunt-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38952, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:44.912531+00:00", "ended_at": "2026-08-26T06:26:47.740403+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d0715abf-4b1e-47fc-98b9-d0e49669f0c1", "name": "primal-civil-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38880, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:40.100960+00:00", "ended_at": "2026-08-26T06:26:46.032390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ff8b1f5-6dc8-4872-8e15-b3f75906b4e5", "name": "misty-ginger-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58876, "username": "hduser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:37.547994+00:00", "ended_at": "2026-08-26T06:26:45.772693+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2d445f93-00c9-4e5f-806d-acd7fa645e44", "name": "stoic-nimble-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58812, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:29.659637+00:00", "ended_at": "2026-08-26T06:26:33.421292+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d4c3b640-0096-4f37-ad66-0f052952c63d", "name": "keen-valiant-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60128, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:23.050112+00:00", "ended_at": "2026-08-26T06:26:26.868156+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2ccd4397-ddf0-4c9a-8392-cc635f74888d", "name": "primal-emerald-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38726, "username": "data", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:18.843774+00:00", "ended_at": "2026-08-26T06:26:24.286465+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "37966986-ff8f-453f-8bdd-84dc288f124f", "name": "forlorn-twilight-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38796, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:12.587457+00:00", "ended_at": "2026-08-26T06:26:17.406522+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b9ac2ee-d466-4c43-a797-ed65937446ed", "name": "graceful-gentle-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49162, "username": "manoj", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:26:09.280015+00:00", "ended_at": "2026-08-26T06:26:16.430411+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "c1c4e3e2-e95e-45ad-9f4e-72ed920b9981", "name": "proud-nautical-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49104, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:55.370895+00:00", "ended_at": "2026-08-26T06:25:58.760276+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c9d21c8e-0906-48d4-9c8d-acebc3df8776", "name": "valiant-wry-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56978, "username": "bernard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:54.827274+00:00", "ended_at": "2026-08-26T06:26:00.300421+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "9aec6d6f-62c9-474b-b1d1-837e00fdd548", "name": "hushed-bronzed-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35796, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:48.554475+00:00", "ended_at": "2026-08-26T06:25:52.123399+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b4f095a-4fa3-4d8c-9fc7-9caad1cc22d8", "name": "fleeting-thawing-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35700, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:42.312155+00:00", "ended_at": "2026-08-26T06:25:46.091854+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd2d6e17-1c52-40cd-a8ec-8bf82fda031b", "name": "umber-smoky-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40342, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:32.926894+00:00", "ended_at": "2026-08-26T06:25:38.742139+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "59d60b35-24ef-4b19-ae5f-0866d27cbfdd", "name": "bold-mellow-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53478, "username": "wizard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:30.985655+00:00", "ended_at": "2026-08-26T06:25:36.432083+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7d2d976b-adbe-46de-93cd-9c05d91edba0", "name": "drifting-bronzed-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40258, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:24.501130+00:00", "ended_at": "2026-08-26T06:25:29.641004+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4d21367c-27ae-439b-859b-79000621c2c8", "name": "lawful-electric-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60088, "username": "mohammad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:23.630777+00:00", "ended_at": "2026-08-26T06:25:28.855086+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "223002b8-6241-4583-85ef-4babe7fe9b72", "name": "bold-burly-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53558, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:17.341109+00:00", "ended_at": "2026-08-26T06:25:23.339721+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e96e9953-a10c-42ac-a4af-32e272bbada7", "name": "opal-earnest-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34948, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:02.460545+00:00", "ended_at": "2026-08-26T06:25:06.482561+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a9c538b-c53f-4d0a-a490-791830769a5b", "name": "snowy-placid-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34892, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:25:02.449622+00:00", "ended_at": "2026-08-26T06:25:07.815057+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b7a538e-c6e7-4530-b6c4-da2fb21ea655", "name": "alpine-wistful-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39148, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:48.989099+00:00", "ended_at": "2026-08-26T06:24:52.789265+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "931d1fce-17e7-4745-a039-1beeafe25d46", "name": "tawny-grassy-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39094, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:45.640170+00:00", "ended_at": "2026-08-26T06:24:49.693740+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45939c5d-7fa7-43c9-9ca6-45bb3ceeb16d", "name": "clever-noble-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43686, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:37.597847+00:00", "ended_at": "2026-08-26T06:24:42.744954+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80419608-6e90-438c-a55c-74c094cee8cf", "name": "blithe-courtly-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43612, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:33.367341+00:00", "ended_at": "2026-08-26T06:24:36.978311+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "baa12bdc-d06d-4885-b5e7-b4ca9a6d41d0", "name": "thorny-brave-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58990, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:29.640072+00:00", "ended_at": "2026-08-26T06:24:35.772371+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b75ae31e-6f3c-4553-85f9-1f73c3b85135", "name": "flinty-vigilant-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41314, "username": "odoo16", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:21.447151+00:00", "ended_at": "2026-08-26T06:24:28.610095+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e181c413-2f5d-465a-83da-c365be2ea038", "name": "cosmic-candid-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45988, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:20.210042+00:00", "ended_at": "2026-08-26T06:24:26.113535+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d25f3ae3-31ed-4456-93c6-e5c64e2d2bd1", "name": "valiant-nameless-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43372, "username": "orange", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:11.974384+00:00", "ended_at": "2026-08-26T06:24:17.870006+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d50e3c6a-9212-4c86-b028-71b3c4693a08", "name": "blithe-creaky-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45922, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:11.891846+00:00", "ended_at": "2026-08-26T06:24:15.909699+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "047b047d-1728-4193-9c74-543767088a6f", "name": "cheerful-thrifty-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41274, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:24:03.372759+00:00", "ended_at": "2026-08-26T06:24:07.135646+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d0ef1288-37d9-48d8-88a2-e32a57713200", "name": "barren-watchful-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48622, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:48.492139+00:00", "ended_at": "2026-08-26T06:23:51.151008+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "29b33bb8-f705-469f-b40b-7672ef44028b", "name": "rambling-lanky-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48664, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:46.626875+00:00", "ended_at": "2026-08-26T06:23:51.807498+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47c8051b-b48a-42e9-bd0f-8233fc87696e", "name": "ginger-idle-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59554, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:42.633551+00:00", "ended_at": "2026-08-26T06:23:48.757863+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f1550fe2-13c5-483a-a27c-7493701edf97", "name": "kindly-lanky-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58982, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:35.721601+00:00", "ended_at": "2026-08-26T06:23:39.797078+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a85d2e4-5be6-4a90-bb11-3d0d21b26259", "name": "balmy-buoyant-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59594, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:35.134927+00:00", "ended_at": "2026-08-26T06:23:37.819714+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5c42e11f-59e1-402d-aab9-9fcea05c043f", "name": "gnarled-jagged-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48044, "username": "term2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:28.705216+00:00", "ended_at": "2026-08-26T06:23:35.011010+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e14ba4e6-fa4c-4b7b-bf2d-ef069ff25591", "name": "hazel-flinty-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48034, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:14.577703+00:00", "ended_at": "2026-08-26T06:23:18.172797+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c90c875d-84b5-4521-bbdd-214582c3c88b", "name": "tidal-sleepy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39058, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:13.059916+00:00", "ended_at": "2026-08-26T06:23:16.723418+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73f1255c-f4cd-4691-a0b7-8cbd5066daa1", "name": "solar-polar-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39022, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:05.487856+00:00", "ended_at": "2026-08-26T06:23:08.850394+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b0924a4-bba4-418b-a918-a86d8755e3dd", "name": "burly-russet-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40740, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:01.910994+00:00", "ended_at": "2026-08-26T06:23:05.271621+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7cd3b81c-5a35-47a6-a87d-fab4eccbad2c", "name": "gallant-vivid-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55306, "username": "niaoyun", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:23:00.828716+00:00", "ended_at": "2026-08-26T06:23:08.747839+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8c592084-b980-44cc-bf54-2679e9ff768c", "name": "orderly-boreal-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49416, "username": "localhost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:47.617673+00:00", "ended_at": "2026-08-26T06:22:53.225177+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "ef73c704-6657-4682-a08f-226fccebd2fb", "name": "woven-amber-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55258, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:45.216861+00:00", "ended_at": "2026-08-26T06:22:50.363677+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bbaff8d0-8ae8-44b1-bec6-ad2c2941ce26", "name": "jaunty-diligent-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49374, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:38.061643+00:00", "ended_at": "2026-08-26T06:22:42.087633+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "91ce76be-019c-42d4-857f-fe28560d6653", "name": "orderly-crystal-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40088, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:27.370239+00:00", "ended_at": "2026-08-26T06:22:33.351744+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4e0c6805-6aae-4dd2-bd38-3aa7bf5ea2e1", "name": "forlorn-humble-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55350, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:20.877184+00:00", "ended_at": "2026-08-26T06:22:25.710898+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "88336b97-c2c9-41b7-ad9a-4dac740f0e04", "name": "solar-genial-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60348, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:17.705956+00:00", "ended_at": "2026-08-26T06:22:23.372713+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "513db314-e65b-4850-a2e5-323077d321d4", "name": "cosmic-ivory-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38748, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:22:00.975830+00:00", "ended_at": "2026-08-26T06:22:05.824199+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f9b5ee3-58e5-4e60-82a8-97d8047d7d64", "name": "marbled-granite-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60268, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:59.862813+00:00", "ended_at": "2026-08-26T06:22:04.101773+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3392d68-7843-4b14-9052-232c3680b5b0", "name": "rugged-umber-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38684, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:58.334716+00:00", "ended_at": "2026-08-26T06:22:03.515927+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8b2a364c-d402-4c26-a127-cc25c10e53d8", "name": "distant-scarlet-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33756, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:56.634595+00:00", "ended_at": "2026-08-26T06:22:03.698424+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "f91e5ac4-72bc-4650-b4a4-de89f5c7b888", "name": "mighty-earnest-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33674, "username": "erpnext", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:46.618749+00:00", "ended_at": "2026-08-26T06:21:54.161553+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "6eeec7bd-4d16-4297-8aed-bf5ea1dcdfd9", "name": "dewy-slender-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56318, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:38.757207+00:00", "ended_at": "2026-08-26T06:21:43.788555+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2983d75f-00e5-4c79-97cc-05561bc29a1a", "name": "gnarled-kindly-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53070, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 234, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:34.680172+00:00", "ended_at": "2026-08-26T06:21:40.084003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e66225a0-db3d-45c7-94ce-8fdbe490ae9a", "name": "craggy-peaty-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53132, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:30.113430+00:00", "ended_at": "2026-08-26T06:21:34.779434+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5208a298-e30d-4aa6-9b07-68f102467607", "name": "vernal-tender-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47568, "username": "aaa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:28.642865+00:00", "ended_at": "2026-08-26T06:21:35.540734+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c7a9339d-c294-4349-8a35-818f532182c6", "name": "patient-freckled-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47532, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:14.802613+00:00", "ended_at": "2026-08-26T06:21:20.208403+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c72bc48a-5fe4-4cb7-beb6-431751cf38b3", "name": "cosmic-frosty-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59696, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:10.324884+00:00", "ended_at": "2026-08-26T06:21:13.485433+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "96dc8073-1157-4e8e-9597-a938a12c85be", "name": "painted-wistful-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59632, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:21:08.071736+00:00", "ended_at": "2026-08-26T06:21:13.923901+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ce4d56b-e3e1-4074-8dcc-98a10eb0381c", "name": "russet-bold-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47920, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:59.355628+00:00", "ended_at": "2026-08-26T06:21:03.443588+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7d67dfba-3ed2-4453-806d-2143d6e7196f", "name": "ruddy-orderly-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52878, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:57.286257+00:00", "ended_at": "2026-08-26T06:21:00.132029+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "02b62f30-5fd6-4668-ad33-bc0df516db57", "name": "bold-wiry-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52832, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:49.349733+00:00", "ended_at": "2026-08-26T06:20:55.426706+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb63bda6-373f-49f3-b28f-f19f0f439d3a", "name": "sandy-slender-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56664, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:44.866115+00:00", "ended_at": "2026-08-26T06:20:49.317397+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58d013a4-cdd7-414c-b87b-c164fc7f85b3", "name": "deft-obsidian-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56610, "username": "kali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:39.637836+00:00", "ended_at": "2026-08-26T06:20:47.759333+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a8cfb999-b71e-431b-829d-50c583d3930a", "name": "jagged-deft-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48662, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:32.192158+00:00", "ended_at": "2026-08-26T06:20:35.805007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2e7dc63a-3730-4058-be0b-3319b1dd4676", "name": "tawny-pristine-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53246, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:19.949213+00:00", "ended_at": "2026-08-26T06:20:25.531544+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8adabb0b-6efd-410c-b2e9-cdccd1d08287", "name": "airy-hardy-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53268, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:19.561090+00:00", "ended_at": "2026-08-26T06:20:24.734762+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fa83dd81-274c-4431-a9f6-0227e2c10021", "name": "drifting-muted-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47428, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:10.856575+00:00", "ended_at": "2026-08-26T06:20:14.230600+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7783ba47-afd5-40b7-9af0-a3be64060ab8", "name": "shifting-quaint-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47388, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:06.081276+00:00", "ended_at": "2026-08-26T06:20:09.483118+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae4b52c8-2a2e-46ef-8496-78f6ef2c82ea", "name": "ruddy-knotted-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:20:03.592824+00:00", "ended_at": "2026-08-26T06:20:07.198678+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78cfe7e1-12e5-45a3-9a51-b4a3754f3014", "name": "painted-fearless-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:58.278529+00:00", "ended_at": "2026-08-26T06:20:02.240365+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c48b9fb-5916-405f-baf1-1205cac87eee", "name": "languid-reedy-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48196, "username": "factorio", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:54.254282+00:00", "ended_at": "2026-08-26T06:20:01.174491+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "698cac39-d9ab-4831-91b4-8f116f01ece6", "name": "wistful-whispering-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49944, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:46.889419+00:00", "ended_at": "2026-08-26T06:19:54.940920+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1dbb2c52-9687-43aa-bdf8-b0ccfb51228a", "name": "gleaming-sterling-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48278, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:44.594624+00:00", "ended_at": "2026-08-26T06:19:50.468011+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e816784a-f2aa-4104-b62d-5cd89d870e98", "name": "civil-scarlet-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59586, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:41.333576+00:00", "ended_at": "2026-08-26T06:19:44.139021+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47803d7a-c760-413a-bd42-d8e8db7f3cac", "name": "sandy-blunt-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49910, "username": "zahra", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:36.859187+00:00", "ended_at": "2026-08-26T06:19:41.739723+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "257b34e4-0dbf-4260-b83e-3cacd01c03d6", "name": "wistful-hushed-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34590, "username": "webmaster", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:21.468206+00:00", "ended_at": "2026-08-26T06:19:26.820886+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "87180860-bb09-4c63-bcce-03791b0077d7", "name": "humble-regal-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34642, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:17.275450+00:00", "ended_at": "2026-08-26T06:19:20.529620+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2501a269-1d23-4dbf-8fa9-1baf552a69d2", "name": "clever-marine-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51282, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:09.334761+00:00", "ended_at": "2026-08-26T06:19:15.202158+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "362dfa37-279b-472b-b0db-6cc686768189", "name": "keen-genial-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51328, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:19:07.931587+00:00", "ended_at": "2026-08-26T06:19:13.223441+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f39bd99e-db7a-4746-aaf8-c796f0f43c86", "name": "blazing-glassy-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50436, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:55.728141+00:00", "ended_at": "2026-08-26T06:18:58.643968+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "abe143a9-4b7f-425b-8564-e07d8c74062b", "name": "electric-seaward-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51876, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:49.568817+00:00", "ended_at": "2026-08-26T06:18:52.606612+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0d7f564-5fb8-4166-8437-9c3b8ab58daf", "name": "indigo-lawful-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51904, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:47.762134+00:00", "ended_at": "2026-08-26T06:18:52.119595+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b722be97-3426-4f33-8a80-413abbeef3fa", "name": "watchful-candid-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44370, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:39.857795+00:00", "ended_at": "2026-08-26T06:18:47.881277+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "e2720f07-2b0b-4309-958c-2eaa22f18a58", "name": "sunlit-blunt-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44362, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:37.922679+00:00", "ended_at": "2026-08-26T06:18:40.874006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bbb0adba-b8f4-40de-8452-0963ad91835a", "name": "gloomy-sincere-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44274, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:34.011133+00:00", "ended_at": "2026-08-26T06:18:37.890681+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d68f4654-1c74-43fd-9f3f-82b7a15bd269", "name": "breezy-marbled-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44966, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:24.179607+00:00", "ended_at": "2026-08-26T06:18:31.407373+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "dcea2bcf-02e0-45d5-a35e-5f956112c016", "name": "loyal-crystal-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45022, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:23.298343+00:00", "ended_at": "2026-08-26T06:18:27.228571+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce947ff5-5898-4231-bbb1-3efe0281dbda", "name": "breezy-somber-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39880, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:10.949921+00:00", "ended_at": "2026-08-26T06:18:16.702715+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45cf9daf-7ee4-4793-9ff1-99f3f75a20f3", "name": "vivid-lofty-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43398, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:18:02.906052+00:00", "ended_at": "2026-08-26T06:18:07.320887+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a853df04-eb1b-489e-b463-3482c198ff45", "name": "gloomy-prickly-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43330, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:53.281151+00:00", "ended_at": "2026-08-26T06:17:58.585646+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e9faa567-c13e-47d4-b2dc-ce5b73ed59de", "name": "blunt-shifting-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58018, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:51.471168+00:00", "ended_at": "2026-08-26T06:17:56.759586+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8f349bd-d13b-4532-a5ac-42ba4f47be4f", "name": "grumpy-breezy-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57946, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:45.985276+00:00", "ended_at": "2026-08-26T06:17:49.911153+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf143489-c4d3-431d-ac4d-980208d68602", "name": "gritty-cheerful-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59264, "username": "lin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:45.418482+00:00", "ended_at": "2026-08-26T06:17:51.242341+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4bc8fb3a-282d-49f3-b0a2-44095cf413f2", "name": "jagged-silent-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58192, "username": "airflow", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:44.546270+00:00", "ended_at": "2026-08-26T06:17:52.049592+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "8530747f-e182-42ed-8186-106be6f8ef77", "name": "bold-sooty-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58148, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:27.204864+00:00", "ended_at": "2026-08-26T06:17:30.532555+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "81a65009-1c92-4314-a9dc-1d511912b1cf", "name": "chilly-wry-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43438, "username": "tempuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:27.065677+00:00", "ended_at": "2026-08-26T06:17:35.361450+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "29ebe8ed-ae0e-4e50-a3ff-d8a64371b7b4", "name": "tranquil-primal-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:24.929737+00:00", "ended_at": "2026-08-26T06:17:29.191870+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "13973a55-16f0-49a7-88a5-8dd7c2920612", "name": "blithe-umber-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43404, "username": "codex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:13.167119+00:00", "ended_at": "2026-08-26T06:17:17.306646+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "9b985347-e1b4-4ddf-907c-094f44c2861e", "name": "granite-wry-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33186, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:11.179796+00:00", "ended_at": "2026-08-26T06:17:18.526024+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "c47517fc-b686-4487-9121-ad02db8a8ee5", "name": "ruddy-rapid-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54408, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:17:09.118167+00:00", "ended_at": "2026-08-26T06:17:12.143302+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b67c82c1-7781-4d9b-a9a6-cfd492b92dec", "name": "jaunty-russet-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33124, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 213, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:16:55.727998+00:00", "ended_at": "2026-08-26T06:17:00.989016+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51a12302-ebca-4a74-844b-edaffed2950e", "name": "obsidian-tender-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57296, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:16:47.858617+00:00", "ended_at": "2026-08-26T06:16:51.705899+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f5cb6aa-2077-4b23-8f6f-ad0e1849c018", "name": "tawny-buoyant-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40842, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:16:30.477845+00:00", "ended_at": "2026-08-26T06:16:35.355125+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28326326-4e84-486b-b673-d138a841b6aa", "name": "electric-airy-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44252, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:16:16.484171+00:00", "ended_at": "2026-08-26T06:16:24.868114+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "1ab6059d-bb0c-4994-93f0-1c212fa3ae95", "name": "chilly-patient-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40796, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:16:11.761253+00:00", "ended_at": "2026-08-26T06:16:17.781885+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11248365-5314-441d-a361-ab0e1c253ebd", "name": "wandering-nimble-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44196, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:55.980887+00:00", "ended_at": "2026-08-26T06:15:56.968645+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "59c78161-cd32-42f6-8821-5a77003e8b51", "name": "languid-amber-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56734, "username": "ossuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:51.840307+00:00", "ended_at": "2026-08-26T06:15:55.982544+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1665 }, { "id": "93df82a6-c9aa-4b48-aa9b-decf74fa74bf", "name": "dappled-leafy-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56698, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:43.265761+00:00", "ended_at": "2026-08-26T06:15:44.381821+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4e676be-cc69-4487-bfe7-37740a7b0c56", "name": "coral-thawing-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50242, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:37.932544+00:00", "ended_at": "2026-08-26T06:15:38.964034+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e49e071-a03b-4672-a586-65952e1346c8", "name": "diligent-western-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54778, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:33.639332+00:00", "ended_at": "2026-08-26T06:15:35.698166+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef091bed-0422-478f-80f5-4dd04a037071", "name": "airy-thorny-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54748, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:24.247039+00:00", "ended_at": "2026-08-26T06:15:25.765676+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "46fec1ce-31bd-43bc-9e75-f499814f6293", "name": "dusky-lucid-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43878, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:21.727957+00:00", "ended_at": "2026-08-26T06:15:23.193889+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d5b1148a-9637-4b11-a65a-d0c7428faab7", "name": "smooth-gentle-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43786, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:15.737315+00:00", "ended_at": "2026-08-26T06:15:16.640427+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a137495f-63c3-4709-9e9c-2c1fc997cea8", "name": "shaded-velvet-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47270, "username": "calvin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:12.725842+00:00", "ended_at": "2026-08-26T06:15:16.406741+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1bd00c71-3b46-4a5d-8280-d8fad43bb22b", "name": "brazen-granite-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47216, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:15:03.977864+00:00", "ended_at": "2026-08-26T06:15:05.962722+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ca3e0500-c404-4292-84ab-bd67a2799dab", "name": "gleaming-quartz-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38518, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:54.912995+00:00", "ended_at": "2026-08-26T06:14:56.786616+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30b3ddcf-a609-46e4-81d6-53c150a94bd2", "name": "bitter-fringed-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52538, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:44.089176+00:00", "ended_at": "2026-08-26T06:14:45.704226+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3dd4d817-7227-4642-966b-63d24baeaaf4", "name": "bronzed-mottled-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52488, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:37.669041+00:00", "ended_at": "2026-08-26T06:14:38.383913+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a3735511-92ad-4b57-9b92-191f170f852d", "name": "slender-foggy-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47852, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:30.231098+00:00", "ended_at": "2026-08-26T06:14:30.652826+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4912ad6e-add5-40c7-bb7e-e39b1d542564", "name": "orderly-wry-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47772, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:26.027675+00:00", "ended_at": "2026-08-26T06:14:26.751762+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8b6f885-3d55-4cf6-8025-843a28a6502d", "name": "sterling-kindly-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42980, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:13.701378+00:00", "ended_at": "2026-08-26T06:14:13.794750+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8a68fe95-2df9-4b71-ab1b-9ee146233572", "name": "ruddy-frugal-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42898, "username": "rock", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:08.357818+00:00", "ended_at": "2026-08-26T06:14:08.489023+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73b96847-f0d7-4f0f-8cb2-8ce95a51d442", "name": "honest-valiant-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51544, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:14:02.615176+00:00", "ended_at": "2026-08-26T06:14:05.467028+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "c1caba66-eab3-4ef7-bb0f-f3d2a19345ab", "name": "breezy-nameless-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56506, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:49.213345+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 3, "transcript_bytes": 233 }, { "id": "e089953a-637b-4951-a3c3-7e7691fd80b5", "name": "wry-solemn-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46022, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:49.180413+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 11, "transcript_bytes": 811 }, { "id": "c7d54ba4-7ce5-487b-b6d0-f73c0e319329", "name": "supple-deft-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56574, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:48.477363+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 2, "transcript_bytes": 147 }, { "id": "cc6e80aa-17cc-46a5-ae17-e2499368d003", "name": "lively-gallant-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54984, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:47.758075+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 8, "transcript_bytes": 611 }, { "id": "f091660f-3c95-4dec-a9de-6972067c10e1", "name": "vigilant-bold-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54482, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:47.688429+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 12, "transcript_bytes": 848 }, { "id": "feff44ca-fcc3-4d7b-99a1-a40a6d27a3f2", "name": "austere-smoky-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34686, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:47.398180+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 14, "transcript_bytes": 1659 }, { "id": "576fac52-5887-483e-83b7-663700c026d6", "name": "solemn-eager-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41544, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:47.357088+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 6, "transcript_bytes": 425 }, { "id": "7fba4bea-ab4a-49e0-9e76-ec940cd75f1d", "name": "tawny-mottled-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46048, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:47.012456+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 9, "transcript_bytes": 664 }, { "id": "5fee772a-6d45-435a-8c79-a0d8ba05e06e", "name": "marine-vernal-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54356, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:45.839337+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 12, "transcript_bytes": 848 }, { "id": "1c8b544f-ee78-4ae1-a679-1b571eff28a5", "name": "sterling-regal-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41608, "username": null, "client_version": "SSH-2.0-Go", "auth_attempts": 0, "automation": null, "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-26T06:13:44.387069+00:00", "ended_at": "2026-08-26T06:13:57.334200+00:00", "ended_reason": "honeypot reconnected", "commands": 4, "transcript_bytes": 239 }, { "id": "90762a16-5b6a-48da-9b75-3f5e46bbe87c", "name": "wry-frugal-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52166, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:13:37.500406+00:00", "ended_at": "2026-08-26T06:13:40.382292+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e784768c-abb9-497a-924a-92440f952d8a", "name": "thawing-wooded-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52092, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:13:36.247692+00:00", "ended_at": "2026-08-26T06:13:44.657153+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5b122705-c8fc-4385-9152-d8de0b6dfcd1", "name": "thorny-lucid-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58012, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:13:17.623209+00:00", "ended_at": "2026-08-26T06:13:20.783551+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dca2be18-bd04-4afe-a926-b323f7f2f687", "name": "solemn-fleeting-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57936, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:13:09.341402+00:00", "ended_at": "2026-08-26T06:13:14.237703+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b8a258db-ad66-487c-ad38-bf51ab15c32c", "name": "icy-hushed-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57962, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:13:08.575012+00:00", "ended_at": "2026-08-26T06:13:13.706777+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37bcab52-cb1c-41e0-bf3c-9492d1c2a220", "name": "craggy-ruddy-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56300, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:13:00.645857+00:00", "ended_at": "2026-08-26T06:13:06.467550+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e0d54987-24a1-483b-86b7-471e4d0db50d", "name": "gleaming-mossy-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 362, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:50.636307+00:00", "ended_at": "2026-08-26T06:12:55.957193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47feb12a-605d-4d84-8481-aa3c59e8f3ac", "name": "granite-balmy-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56246, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:50.278687+00:00", "ended_at": "2026-08-26T06:12:54.023459+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7492128-7650-4282-8dc2-81abe6d6e47b", "name": "airy-earnest-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59904, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:42.719420+00:00", "ended_at": "2026-08-26T06:12:46.238007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "89bcd23e-1948-4a51-b370-bd93f99bb725", "name": "sturdy-lucid-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37592, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:39.407265+00:00", "ended_at": "2026-08-26T06:12:45.271802+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c552b218-6947-4cab-9bf9-129ab4379f9b", "name": "ginger-diligent-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34918, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:34.623376+00:00", "ended_at": "2026-08-26T06:12:37.310171+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d798e2f-522b-4b79-8da6-6f0712520607", "name": "ivory-vigilant-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37554, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:33.529756+00:00", "ended_at": "2026-08-26T06:12:38.836298+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c658de9e-9f45-40e1-ab36-8ffd339e1221", "name": "jaunty-creaky-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44708, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:22.997331+00:00", "ended_at": "2026-08-26T06:12:27.238725+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e9e1ca9-ed53-4ba7-8e9f-120ff5e08339", "name": "hardy-pewter-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44664, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:12.858526+00:00", "ended_at": "2026-08-26T06:12:16.563846+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "240148bd-c348-432f-93d6-43fe4b805c85", "name": "lawful-creaky-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54146, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:10.362087+00:00", "ended_at": "2026-08-26T06:12:14.212792+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28c5bbee-c882-4e51-a1b8-dee15cc26be9", "name": "blunt-twilight-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46892, "username": "nutanix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:10.247989+00:00", "ended_at": "2026-08-26T06:12:18.253491+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "190caa2f-9c27-47cb-8e12-a2e2ef70ca53", "name": "breezy-patient-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54040, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:12:10.081383+00:00", "ended_at": "2026-08-26T06:12:13.925690+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "010360d3-6b8d-4811-ae82-4a1cbbeada0c", "name": "ginger-blazing-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35880, "username": "amin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:55.467219+00:00", "ended_at": "2026-08-26T06:12:02.800319+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "761fdc36-0e31-4e0e-8b13-c1ff2ba547c5", "name": "honest-emerald-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60682, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:54.853113+00:00", "ended_at": "2026-08-26T06:11:59.812427+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1b0afadd-739c-4275-9faa-6a7563ec316b", "name": "mellow-coastal-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46832, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:50.028846+00:00", "ended_at": "2026-08-26T06:11:53.948146+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "560c6b0e-dd49-4ad5-999f-b80ee99cb1f3", "name": "painted-solar-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35790, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:36.811059+00:00", "ended_at": "2026-08-26T06:11:39.510762+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "33396b11-a861-4823-8522-e71a0ec58ff6", "name": "lunar-sooty-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36274, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:34.688275+00:00", "ended_at": "2026-08-26T06:11:38.510690+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c5b24c30-f9b6-4811-bbe5-5ea5f3cef722", "name": "humble-creaky-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36214, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:27.499078+00:00", "ended_at": "2026-08-26T06:11:31.653579+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "98a6c7bd-886a-42cb-9d35-fa95482b9901", "name": "hushed-electric-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50768, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:21.030727+00:00", "ended_at": "2026-08-26T06:11:24.486880+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1bd0b7f9-55b6-48c0-9bfd-0289002814a2", "name": "twilight-supple-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50704, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:20.745799+00:00", "ended_at": "2026-08-26T06:11:25.775834+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "588115fd-a640-48f1-b4d4-1c79e6d4d31c", "name": "gentle-civil-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59582, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:11:09.371039+00:00", "ended_at": "2026-08-26T06:11:13.457684+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "20ad7339-44f0-415b-8a57-6984c141f0fd", "name": "autumn-lawful-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54010, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:58.659938+00:00", "ended_at": "2026-08-26T06:11:02.392254+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e087668f-b081-4c1c-834b-116d2a97b6b3", "name": "fabled-gallant-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60822, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:54.383604+00:00", "ended_at": "2026-08-26T06:10:59.293057+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d800fb7-1d2f-427d-bd2b-15e2a0b9d343", "name": "brisk-electric-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53964, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:52.206150+00:00", "ended_at": "2026-08-26T06:10:56.905138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bae69316-1c31-4db7-9c92-f37079914318", "name": "vivid-hazel-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60786, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:47.888928+00:00", "ended_at": "2026-08-26T06:10:51.066674+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8320ce8c-93b9-44b9-96c7-70bc2ac4065e", "name": "graceful-inland-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56132, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 175, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:37.674186+00:00", "ended_at": "2026-08-26T06:10:41.736117+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "137def02-9f48-44f1-9335-4f608c049836", "name": "mottled-graceful-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34776, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:30.007127+00:00", "ended_at": "2026-08-26T06:10:35.969727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "857c1569-10ae-4c5c-b681-bde4008053ad", "name": "ruddy-airy-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56802, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:26.203187+00:00", "ended_at": "2026-08-26T06:10:29.603681+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9717accc-5d5e-43d9-8769-ee2006ca360b", "name": "cobalt-languid-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34730, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:26.118390+00:00", "ended_at": "2026-08-26T06:10:32.244036+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ece44a1d-0bb0-408a-a219-858f796a204a", "name": "solemn-foggy-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56744, "username": "almalinux", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:24.424923+00:00", "ended_at": "2026-08-26T06:10:31.348738+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "987741d6-a71e-43d3-aca7-642c3efc867a", "name": "proud-loyal-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58904, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:08.779262+00:00", "ended_at": "2026-08-26T06:10:14.779174+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6e0f025a-cffd-4027-b03f-06adac9f2ba6", "name": "lanky-tranquil-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58784, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:05.401928+00:00", "ended_at": "2026-08-26T06:10:09.191997+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73a432ed-7480-4f3e-b9c7-c7bc70e4d5b8", "name": "distant-blazing-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53528, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:10:01.838753+00:00", "ended_at": "2026-08-26T06:10:07.900271+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4094d09a-2657-49fc-87f0-0a26456cdce3", "name": "hearty-nautical-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37528, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:52.942314+00:00", "ended_at": "2026-08-26T06:09:58.883027+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b9dc4727-043e-4375-b6c8-2cf5ec49300d", "name": "pewter-jovial-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37466, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:47.984545+00:00", "ended_at": "2026-08-26T06:09:52.417842+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e77db003-4842-4757-99b8-2852b9060a9f", "name": "whispering-plush-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51346, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:46.733412+00:00", "ended_at": "2026-08-26T06:09:52.175187+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "77591302-9919-427d-833f-2a32d4d22d96", "name": "velvet-marine-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51280, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:34.170933+00:00", "ended_at": "2026-08-26T06:09:37.573085+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "25026f92-f18b-4254-a8bd-ea72e0d8007b", "name": "kindly-fleeting-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49752, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:28.434405+00:00", "ended_at": "2026-08-26T06:09:31.696340+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9cdebd37-f588-4be7-b043-fa150624fb3a", "name": "amiable-forlorn-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49798, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:25.645936+00:00", "ended_at": "2026-08-26T06:09:28.996312+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9d0e3e0-764c-4c9a-b8dc-86377b6fbc6d", "name": "jovial-emerald-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35528, "username": "grid", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:22.986399+00:00", "ended_at": "2026-08-26T06:09:28.778382+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3cc00743-5a52-43be-a08e-a561a3726308", "name": "humble-arctic-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38160, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:12.606072+00:00", "ended_at": "2026-08-26T06:09:15.223898+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "671d432b-7b0c-4999-af72-3be21d270443", "name": "hearty-calm-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34488, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:07.607457+00:00", "ended_at": "2026-08-26T06:09:12.905432+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ec80f05-7835-4c3e-b554-4fbbfc1fa016", "name": "tawny-patient-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38138, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:09:06.232441+00:00", "ended_at": "2026-08-26T06:09:10.137897+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e4719e48-70f0-424b-94c4-2434546eccc5", "name": "early-rapid-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34446, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:53.310029+00:00", "ended_at": "2026-08-26T06:08:56.481605+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "997d26f8-44a8-4535-ae5e-ed280fd01379", "name": "faded-courtly-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59768, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:45.450140+00:00", "ended_at": "2026-08-26T06:08:52.623624+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3dd8d43a-7db0-45cf-b10e-36115af19c77", "name": "patient-peaty-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44182, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:44.675194+00:00", "ended_at": "2026-08-26T06:08:48.290664+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73ae2c8d-f636-481a-9039-ef03aa5c0f55", "name": "crystal-placid-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44080, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 171, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:42.437144+00:00", "ended_at": "2026-08-26T06:08:48.338570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1941813b-d32f-4263-81ec-1832655c85f0", "name": "subtle-cosmic-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48868, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:33.074783+00:00", "ended_at": "2026-08-26T06:08:35.947516+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fa8ff7d6-6e69-4956-a242-d2d88fd2f7cc", "name": "windswept-creaky-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48812, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:28.583169+00:00", "ended_at": "2026-08-26T06:08:32.957556+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e4011c23-c64b-4144-aa11-08dfcc481eb0", "name": "graceful-courtly-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47260, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:27.853946+00:00", "ended_at": "2026-08-26T06:08:34.127097+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "614839ff-a764-4cb7-9c95-a14f955a47b0", "name": "gnarled-dusky-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47196, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:12.642425+00:00", "ended_at": "2026-08-26T06:08:16.068417+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "953939df-00d4-443a-8377-1f1ca2afb5bd", "name": "wry-lucid-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34746, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:07.272996+00:00", "ended_at": "2026-08-26T06:08:09.889209+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d6d1ad80-2ea0-4d49-b699-852389e453de", "name": "languid-twilight-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41716, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:08:05.539417+00:00", "ended_at": "2026-08-26T06:08:09.959620+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "174b26f9-bb95-46f7-9312-7cb124c8eac3", "name": "nautical-gallant-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34688, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:53.700572+00:00", "ended_at": "2026-08-26T06:07:59.386613+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c6afb735-d4c5-42ac-929e-a749c20c86d5", "name": "lanky-foggy-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53814, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:49.596631+00:00", "ended_at": "2026-08-26T06:07:54.950016+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3069d9e7-8ff9-4acd-8568-7b31ed32527d", "name": "lucid-mottled-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46278, "username": "ali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:48.712183+00:00", "ended_at": "2026-08-26T06:07:56.032331+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "dd66e22f-bb91-40fc-8b95-72d344159ec0", "name": "nautical-quiet-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53778, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:47.700390+00:00", "ended_at": "2026-08-26T06:07:50.574777+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac5617af-b96e-43e1-9c39-468b90486437", "name": "glassy-nautical-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46410, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:40.780055+00:00", "ended_at": "2026-08-26T06:07:45.516400+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1341acc4-b29f-4795-b25d-778ed0797fd6", "name": "balmy-spirited-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60162, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:37.737965+00:00", "ended_at": "2026-08-26T06:07:42.276638+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9d5762fb-b95f-471b-ab40-c1138257fe1b", "name": "shaded-regal-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54654, "username": "tactical", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:24.204114+00:00", "ended_at": "2026-08-26T06:07:31.650079+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "62d9b9bd-6d40-4797-ad3c-c52870bb6ace", "name": "fleeting-alpine-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54710, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:23.543398+00:00", "ended_at": "2026-08-26T06:07:27.589497+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bde10327-b32a-440e-b1b8-671a896131a7", "name": "valiant-marine-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47718, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:11.009384+00:00", "ended_at": "2026-08-26T06:07:14.298093+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1db0f54b-a14a-4e49-b8b6-c3a0c4de3132", "name": "sleepy-hearty-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47684, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:04.491303+00:00", "ended_at": "2026-08-26T06:07:09.961086+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6dd3ead8-b67d-4e69-a7ea-81b98b733c1a", "name": "gilded-murky-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36016, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:07:03.849218+00:00", "ended_at": "2026-08-26T06:07:07.823806+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3f8563e4-206e-404a-a932-7a866c75c1a5", "name": "twilight-proud-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59056, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:53.614999+00:00", "ended_at": "2026-08-26T06:06:59.264955+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa4f9424-7b60-46da-9d92-82acd35079d5", "name": "courtly-brazen-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58978, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:46.814185+00:00", "ended_at": "2026-08-26T06:06:52.701726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7da5b552-2d47-45f7-8003-55f43874ba0f", "name": "pewter-faded-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55130, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:38.782151+00:00", "ended_at": "2026-08-26T06:06:42.731870+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c656b613-e855-44a0-80cb-a864d445c8bb", "name": "slender-polar-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55164, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 175, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:37.977666+00:00", "ended_at": "2026-08-26T06:06:41.088371+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04a2290d-0e93-48e1-94fa-a54b20f54b60", "name": "brave-slender-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51624, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:33.555404+00:00", "ended_at": "2026-08-26T06:06:38.837606+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2755bc03-a292-4a1f-a52d-b0c59db8cb86", "name": "amber-craggy-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51560, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:23.641220+00:00", "ended_at": "2026-08-26T06:06:27.479914+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5aba0fe3-230b-4c69-a2b6-673bb4400e19", "name": "buoyant-slender-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33032, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:18.841193+00:00", "ended_at": "2026-08-26T06:06:23.943406+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0dc5bc1e-995e-4fd2-b92d-e60b7e4e2d19", "name": "knotted-primal-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47932, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:18.263500+00:00", "ended_at": "2026-08-26T06:06:21.932611+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "93e362bf-58aa-49f1-b34f-db6345dfa900", "name": "steady-bronzed-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52870, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:05.444351+00:00", "ended_at": "2026-08-26T06:06:11.476701+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "107a27b5-2d04-4a86-9fe7-6455c6feb00d", "name": "dewy-dutiful-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 32960, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:06:04.806008+00:00", "ended_at": "2026-08-26T06:06:07.461191+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6352c02e-0826-4010-8cc3-e5011381c0ac", "name": "rugged-subtle-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52844, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 181, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:55.046936+00:00", "ended_at": "2026-08-26T06:05:59.434109+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4d0f3b3c-89e8-4bb1-ac91-b292837dbc62", "name": "sturdy-thawing-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38024, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:47.092080+00:00", "ended_at": "2026-08-26T06:05:52.912100+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "df5b5dda-778c-4d1e-86e9-7fd08bacce17", "name": "plush-polar-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48846, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:41.626241+00:00", "ended_at": "2026-08-26T06:05:46.264287+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b6fa55a8-66f4-4927-aff9-2b14895e00f8", "name": "sandy-patient-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50870, "username": "gabriel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:38.517663+00:00", "ended_at": "2026-08-26T06:05:42.261548+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "60609c0e-62b6-40b1-84b5-bd79c19f69e5", "name": "glassy-jagged-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48786, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:34.230023+00:00", "ended_at": "2026-08-26T06:05:39.357161+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58691fdd-c18d-40b2-abd2-9e37a04e8287", "name": "glassy-early-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43512, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:33.296270+00:00", "ended_at": "2026-08-26T06:05:42.211340+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "8cd6cf43-a992-4ed5-95d6-de83cf1cc751", "name": "courtly-craggy-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50806, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:26.157378+00:00", "ended_at": "2026-08-26T06:05:30.588248+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fad0f6ac-df64-4a8e-933f-12b83b2ca095", "name": "coastal-solar-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53664, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:14.186286+00:00", "ended_at": "2026-08-26T06:05:17.152394+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "453e0304-a5be-4116-a233-6cc3ed894f1b", "name": "honest-knotted-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43424, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:11.180999+00:00", "ended_at": "2026-08-26T06:05:17.153432+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cbfeb0f6-658e-437d-86be-013a11601240", "name": "craggy-feral-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53574, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:10.636277+00:00", "ended_at": "2026-08-26T06:05:17.000533+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "56201afa-5070-4e10-ada0-6be88c85d2c2", "name": "graceful-merry-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46944, "username": "potok", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:05:09.115069+00:00", "ended_at": "2026-08-26T06:05:12.431091+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e0617f48-34b2-4121-9d66-24f59db606c4", "name": "silent-calm-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53812, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:51.264903+00:00", "ended_at": "2026-08-26T06:04:56.457842+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "561a115e-23f5-48ca-8f8a-170fd77c451f", "name": "supple-calm-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53776, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:45.157047+00:00", "ended_at": "2026-08-26T06:04:48.836216+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "608fb39c-26b6-43bf-9947-d5b8e4141d34", "name": "chilly-keen-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60742, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:36.335058+00:00", "ended_at": "2026-08-26T06:04:40.251516+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8e1b7e5-130d-49d5-8cf2-4841e82c624b", "name": "spirited-hardy-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60678, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:36.323340+00:00", "ended_at": "2026-08-26T06:04:41.624678+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "23f0cd30-75f2-4dc5-b441-8563ec608ea6", "name": "placid-smoky-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43004, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:24.642454+00:00", "ended_at": "2026-08-26T06:04:28.600079+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e421d668-2b33-4c20-a2cb-e9499cdb1f9b", "name": "graceful-lunar-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53372, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:24.071296+00:00", "ended_at": "2026-08-26T06:04:28.658385+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "53bfaaf6-d52e-446b-bb67-ebd5a8fbdff8", "name": "bitter-wry-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42930, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 262, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:17.733384+00:00", "ended_at": "2026-08-26T06:04:22.811222+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "216ae082-d7a8-4988-a400-74dcaf751e26", "name": "plucky-ivory-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59004, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:15.841160+00:00", "ended_at": "2026-08-26T06:04:21.766438+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28f7dee0-de02-47ba-8f1c-4a36472ddb81", "name": "fabled-granite-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55202, "username": "devuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:11.864953+00:00", "ended_at": "2026-08-26T06:04:18.284378+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "a2a338b5-4a94-457d-b277-90313bc97f31", "name": "genial-pewter-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58936, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:04:08.765680+00:00", "ended_at": "2026-08-26T06:04:15.034755+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "27f8c79e-5017-4b8d-ac3d-5d2166f50ffa", "name": "gentle-cheerful-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44452, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:59.025751+00:00", "ended_at": "2026-08-26T06:04:04.916473+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "063a6bd2-db32-4afa-9eeb-9c4b1af8680c", "name": "ginger-cheerful-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33190, "username": "opc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:47.609534+00:00", "ended_at": "2026-08-26T06:03:56.146127+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ebe3b30e-e532-4763-8630-ff12ec216dcd", "name": "forlorn-solemn-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44408, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:42.610155+00:00", "ended_at": "2026-08-26T06:03:45.657998+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9d16e692-98ea-44bf-ba7e-356c36d4afd0", "name": "hardy-canny-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33268, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:40.371051+00:00", "ended_at": "2026-08-26T06:03:44.264315+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "149fd326-1756-45c8-9f08-1d765bb57caf", "name": "hardy-serene-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56252, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:32.002248+00:00", "ended_at": "2026-08-26T06:03:36.695550+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "54df4f05-9bb9-4510-84f7-3c337229089f", "name": "mellow-gallant-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56604, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:27.148711+00:00", "ended_at": "2026-08-26T06:03:32.133773+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2b35c5df-9854-4019-af44-74b4e4890ed4", "name": "blazing-hazy-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51720, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:24.244324+00:00", "ended_at": "2026-08-26T06:03:29.192605+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "b3b02956-a393-42f6-8dd3-5ec51b9ef014", "name": "frugal-murky-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56564, "username": "user4", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:22.937860+00:00", "ended_at": "2026-08-26T06:03:27.182668+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "66d4a89a-63ac-4518-9d72-9386e41287e3", "name": "wry-frank-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51672, "username": "mc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:18.098087+00:00", "ended_at": "2026-08-26T06:03:21.196673+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "0c15a1a5-f9b9-4b94-84fa-0eaa4da1cd4d", "name": "cunning-deft-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37926, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 175, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:02.878347+00:00", "ended_at": "2026-08-26T06:03:11.061637+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "28dc3da7-c615-48c2-82d7-1d6696c41696", "name": "gritty-dewy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37948, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:03:00.386563+00:00", "ended_at": "2026-08-26T06:03:03.121710+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "396a8335-f7ab-4ee1-abf9-b97b67183173", "name": "indigo-thrifty-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37248, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:46.635623+00:00", "ended_at": "2026-08-26T06:02:51.305504+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f4cb7e9-994c-445c-8ed3-7e3a5f9eec0d", "name": "gloomy-obsidian-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44792, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:43.597115+00:00", "ended_at": "2026-08-26T06:02:47.984285+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a4cfa6d8-4478-41f9-b348-5265c4cdf71a", "name": "languid-restless-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44752, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:42.364362+00:00", "ended_at": "2026-08-26T06:02:50.717904+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a054b04d-6f9a-4e5c-a7e0-8687f430a743", "name": "jolly-amber-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49358, "username": "doris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:35.770964+00:00", "ended_at": "2026-08-26T06:02:40.807944+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e7e394cf-da4b-46da-83e9-3f7365242a20", "name": "bitter-salty-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49272, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 241, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:31.325281+00:00", "ended_at": "2026-08-26T06:02:36.716651+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "798b22db-63fa-496a-ae64-5d1a665102d3", "name": "snowy-kindly-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59612, "username": "odoo14", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:20.948559+00:00", "ended_at": "2026-08-26T06:02:28.872905+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4569ee24-a474-4e14-a87b-6027ad7f2d4b", "name": "gnarled-drifting-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45806, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:11.839365+00:00", "ended_at": "2026-08-26T06:02:14.627051+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "761bc21d-5c11-422e-b251-2e7d9831455e", "name": "deft-placid-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45720, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:07.806756+00:00", "ended_at": "2026-08-26T06:02:11.667371+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d480dff-7998-4f65-a7c6-99ea7660b06c", "name": "opal-grumpy-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60240, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:02:02.346010+00:00", "ended_at": "2026-08-26T06:02:08.218723+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2e556e1f-0cdf-4707-b2de-480596b5e216", "name": "bronzed-solemn-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60172, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:56.722634+00:00", "ended_at": "2026-08-26T06:02:00.330916+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd689ffe-0b6d-4455-8b50-bf652863c8ce", "name": "gloomy-slender-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33974, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:49.973854+00:00", "ended_at": "2026-08-26T06:01:58.415513+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b23e1f3d-c2bd-475b-9a09-0aab0de8da26", "name": "thrifty-foggy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33106, "username": "user3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:47.280647+00:00", "ended_at": "2026-08-26T06:01:53.535645+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e5c6af3a-08e9-473f-a40b-4718576e8e73", "name": "leafy-cosmic-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53852, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:39.745585+00:00", "ended_at": "2026-08-26T06:01:45.256102+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8ea56de-6886-4915-b707-ee791c7e1bd4", "name": "buoyant-keen-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53898, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:38.169168+00:00", "ended_at": "2026-08-26T06:01:42.702114+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d7e4ac0-e480-47f8-8990-4fa7211bcf45", "name": "jagged-candid-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33044, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:29.736722+00:00", "ended_at": "2026-08-26T06:01:34.176840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9a43b680-7e26-4fee-a5bc-45364ade587c", "name": "pristine-knotted-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52588, "username": "sol", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:20.898767+00:00", "ended_at": "2026-08-26T06:01:28.689217+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "74180c04-56b1-4247-9f06-919fd2fbc99c", "name": "graceful-indigo-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52660, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:18.272951+00:00", "ended_at": "2026-08-26T06:01:21.929999+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e7151e8-a2fa-4db8-9220-67aa11966139", "name": "freckled-hazy-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45254, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:12.758578+00:00", "ended_at": "2026-08-26T06:01:17.678518+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "17d7abd6-c5d0-40fc-a29a-4357634a2e30", "name": "placid-meadow-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50248, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:01:02.470419+00:00", "ended_at": "2026-08-26T06:01:05.988426+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ebf5f0e2-910b-451d-9997-cec90305a63e", "name": "vaulted-arctic-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50206, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:53.417664+00:00", "ended_at": "2026-08-26T06:00:56.202921+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b7f97f4c-d908-403b-97a1-1e711381c29a", "name": "buoyant-slender-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44174, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:46.807654+00:00", "ended_at": "2026-08-26T06:00:52.792325+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "705776fe-e1d1-422b-9ab1-45d94e2cb41a", "name": "courtly-brazen-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44224, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:46.313651+00:00", "ended_at": "2026-08-26T06:00:50.786346+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31ee4efe-d95f-490c-a154-d8c30a3f48cd", "name": "sturdy-lonesome-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38992, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:44.837119+00:00", "ended_at": "2026-08-26T06:00:47.881258+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d0d77e9-4a4d-47fa-bfad-bfd8fdeefa0a", "name": "verdant-dapper-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54874, "username": "teste", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:31.685742+00:00", "ended_at": "2026-08-26T06:00:36.931045+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bba10b17-fa53-4bb0-ba3d-0082f3fe6cc4", "name": "coral-noble-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54942, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:29.121621+00:00", "ended_at": "2026-08-26T06:00:34.008031+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2084afa7-e36a-4d0f-83b6-8b83c42d46f1", "name": "salty-jovial-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48070, "username": "kafka", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:16.776739+00:00", "ended_at": "2026-08-26T06:00:26.065224+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "57c96859-fa29-4f99-afa1-6e3f7ad454d5", "name": "cunning-supple-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55496, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:16.312538+00:00", "ended_at": "2026-08-26T06:00:22.284519+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a04bd72d-9a35-4fb8-a415-fadaa62b25c8", "name": "sincere-vernal-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55420, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:14.868183+00:00", "ended_at": "2026-08-26T06:00:18.403456+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d8df6a5-49a9-4821-a9e9-64986bc6458f", "name": "dusty-vaulted-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47986, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:09.705654+00:00", "ended_at": "2026-08-26T06:00:16.774540+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "33df2463-1f19-4b86-92f4-6dd6beea7ef1", "name": "rustic-dutiful-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54344, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T06:00:08.317631+00:00", "ended_at": "2026-08-26T06:00:11.417137+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c9e85ff1-7502-4540-b057-9f56ac80d150", "name": "deft-gallant-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41450, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:55.995613+00:00", "ended_at": "2026-08-26T06:00:00.587796+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b6494b0-250e-4709-b93a-513847040254", "name": "verdant-western-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 41550, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:43.520138+00:00", "ended_at": "2026-08-26T05:59:46.499195+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73ab920e-6c8f-4944-b566-915b575b68ec", "name": "austere-slender-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50326, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:43.094722+00:00", "ended_at": "2026-08-26T05:59:49.119072+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2e3a9b8-a153-40b3-b2f4-7c43d09b02bd", "name": "vivid-bitter-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46774, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:42.232615+00:00", "ended_at": "2026-08-26T05:59:49.653071+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "df336bb3-2e1a-48c1-9a00-02c7ca4cb4be", "name": "jolly-sunlit-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44154, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:38.243374+00:00", "ended_at": "2026-08-26T05:59:43.641916+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "bae3065f-b7bb-44d4-ad5e-c94c0c9bc788", "name": "blunt-quaint-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50274, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:30.998165+00:00", "ended_at": "2026-08-26T05:59:34.146180+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d37daedb-dd3d-4715-938f-c74709326005", "name": "humble-rugged-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47940, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:22.197277+00:00", "ended_at": "2026-08-26T05:59:29.026008+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "dc0a5b9b-8edb-4d92-968c-26e6930a5903", "name": "amiable-twilight-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46688, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:14.502387+00:00", "ended_at": "2026-08-26T05:59:17.836159+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a4be4f3e-64b6-40c1-83b4-68a493eab519", "name": "dewy-glassy-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47970, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:59:10.914341+00:00", "ended_at": "2026-08-26T05:59:14.843625+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1cc5dd63-6f82-469f-bd9a-bffb725b59ef", "name": "calm-humble-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58212, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:58.803203+00:00", "ended_at": "2026-08-26T05:59:03.954699+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c636f5cd-9260-4b7c-8b9a-4882ed4e4ebe", "name": "knotted-prairie-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58158, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:54.411389+00:00", "ended_at": "2026-08-26T05:58:57.187464+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f3a9964b-bb32-4117-9fb7-efa73bc045da", "name": "hollow-prickly-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42290, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:43.586218+00:00", "ended_at": "2026-08-26T05:58:47.726823+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07ffdd8c-c086-4b11-ae6c-c435319912a8", "name": "patient-foggy-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48966, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:39.932038+00:00", "ended_at": "2026-08-26T05:58:45.284998+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0259fd1a-2a8c-44b6-bde4-169743eac966", "name": "merry-russet-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48910, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:35.211327+00:00", "ended_at": "2026-08-26T05:58:41.057137+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b4aba1ce-fa56-4c06-98fa-3056e2240fdf", "name": "honest-diligent-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59148, "username": "cursor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:26.165440+00:00", "ended_at": "2026-08-26T05:58:31.475241+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f41c24d1-29b1-4509-ba5f-08e0bd5cd66f", "name": "seaward-flinty-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44622, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:23.764740+00:00", "ended_at": "2026-08-26T05:58:27.527070+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d93e0add-5c67-46d4-9278-5e4d680b4a66", "name": "scarlet-sterling-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56740, "username": "qw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:21.388722+00:00", "ended_at": "2026-08-26T05:58:29.509112+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "b01f5efd-5373-49f6-8b91-e8edd57f8627", "name": "quartz-pristine-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59062, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:11.314296+00:00", "ended_at": "2026-08-26T05:58:14.674264+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd849a91-7390-404f-92b5-2a1a4856c03e", "name": "solemn-sooty-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56790, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:03.952630+00:00", "ended_at": "2026-08-26T05:58:08.707808+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6a535667-577a-4f7f-9007-50e40d1c249f", "name": "sleepy-crimson-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52168, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:58:03.859110+00:00", "ended_at": "2026-08-26T05:58:08.971458+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e2c69af6-5763-4335-ace3-1b4aebe4289e", "name": "alpine-thrifty-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56720, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:55.673628+00:00", "ended_at": "2026-08-26T05:58:00.842875+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "004ebd2d-db8d-4991-a652-7a6f08332128", "name": "solar-upland-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40318, "username": "uploader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:52.136603+00:00", "ended_at": "2026-08-26T05:57:57.476125+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "2e244bc8-8f93-4367-a20c-7e250fcd898c", "name": "quiet-pewter-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47588, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 255, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:46.059504+00:00", "ended_at": "2026-08-26T05:57:53.656804+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "ae259a2e-eb46-4566-9090-447a58830d75", "name": "velvet-mottled-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52072, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:43.491561+00:00", "ended_at": "2026-08-26T05:57:49.104085+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f516405-3fd5-4857-a7bd-55ce81216e2b", "name": "murky-craggy-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60750, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:35.411448+00:00", "ended_at": "2026-08-26T05:57:42.053005+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "d7374f09-d703-4327-b5fd-5c347408ee2f", "name": "sandy-solar-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47520, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:23.847347+00:00", "ended_at": "2026-08-26T05:57:27.385614+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "407b5c46-16bd-49a1-a2c2-b1377f7750a4", "name": "gloomy-forlorn-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60668, "username": "fivem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:19.690032+00:00", "ended_at": "2026-08-26T05:57:27.115235+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b2a7bb03-6c2e-4a99-9483-ca29618f7055", "name": "lofty-cobalt-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60316, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:14.688478+00:00", "ended_at": "2026-08-26T05:57:18.954159+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4fa9e02c-ea19-4810-83da-cb3be3de7084", "name": "lonesome-reedy-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49748, "username": "arthur", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:09.729152+00:00", "ended_at": "2026-08-26T05:57:16.300353+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2851272c-2a3b-489c-bca4-a1810d5560b9", "name": "quiet-humble-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60222, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:57:01.868014+00:00", "ended_at": "2026-08-26T05:57:05.747032+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9d11952-fe9f-4250-91bc-b5b524931158", "name": "craggy-graceful-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59404, "username": "osmc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:53.422416+00:00", "ended_at": "2026-08-26T05:57:01.277798+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2f84fbb8-4149-418d-ae2b-2fe6455a4ad2", "name": "salty-daring-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59454, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:52.345728+00:00", "ended_at": "2026-08-26T05:56:57.114018+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "94250d52-062c-449a-98d5-923a5cddfbc0", "name": "sullen-honest-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49482, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:40.337511+00:00", "ended_at": "2026-08-26T05:56:44.499899+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a80d4894-01ad-4d36-a502-09d995b3aa64", "name": "murky-fierce-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49430, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:34.384240+00:00", "ended_at": "2026-08-26T05:56:38.313132+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b34a2d3b-7ef6-47b8-9cde-6b46a5879f21", "name": "grassy-wooded-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54434, "username": "trade", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:34.218939+00:00", "ended_at": "2026-08-26T05:56:37.730294+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "60427b4c-026a-4c9e-85ce-12a12b41f506", "name": "opal-feral-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54326, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:27.686102+00:00", "ended_at": "2026-08-26T05:56:32.843541+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "79271659-33e7-4092-84be-40e0794772fb", "name": "courtly-lofty-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38196, "username": "lucas", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:19.272895+00:00", "ended_at": "2026-08-26T05:56:27.388030+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "10042a9e-5bb4-4025-b57e-fff802668182", "name": "frosty-crystal-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38244, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:18.349241+00:00", "ended_at": "2026-08-26T05:56:21.401858+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a374cea2-530e-4709-b4b3-f88edc97f729", "name": "mellow-electric-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:12.955647+00:00", "ended_at": "2026-08-26T05:56:18.857443+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "65b0f0cc-f200-433e-9b86-fd3a9c52ce72", "name": "quiet-faded-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38166, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:08.880578+00:00", "ended_at": "2026-08-26T05:56:12.680448+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35a78e3b-d18a-462b-bba9-0576a17b7a48", "name": "vigilant-sandy-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 367, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:56:05.826704+00:00", "ended_at": "2026-08-26T05:56:10.429275+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d728928-0c9b-48c7-9c18-8e843fecd225", "name": "austere-mighty-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60574, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:59.572656+00:00", "ended_at": "2026-08-26T05:56:05.108196+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49d9a444-ffea-4347-9264-7271668c695f", "name": "hushed-courtly-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60550, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:52.070123+00:00", "ended_at": "2026-08-26T05:55:58.097750+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1cf57bd1-91eb-462e-bd08-743faa7035e9", "name": "foggy-dutiful-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48248, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:44.088903+00:00", "ended_at": "2026-08-26T05:55:48.005616+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0c29ee32-7742-4217-8fe1-1f1f817371e4", "name": "watchful-calm-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:40.074835+00:00", "ended_at": "2026-08-26T05:55:44.757188+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5bb71805-d894-446a-9c60-69b59f96a390", "name": "valiant-eager-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55328, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:30.327343+00:00", "ended_at": "2026-08-26T05:55:34.559219+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "386a9cc1-dd06-4331-88b6-4dc1c393041e", "name": "icy-plucky-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55276, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:28.509905+00:00", "ended_at": "2026-08-26T05:55:31.743321+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "671f2f57-f9b7-475e-9bf3-53c875a87769", "name": "lively-pewter-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44248, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:16.032555+00:00", "ended_at": "2026-08-26T05:55:19.650476+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eca55cdb-c3d7-44c3-ad30-c3365af23811", "name": "placid-sandy-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49432, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:12.200635+00:00", "ended_at": "2026-08-26T05:55:17.612026+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "468cad38-1111-432b-8ef6-0b98d3c4193b", "name": "chilly-dusky-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49360, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:10.883369+00:00", "ended_at": "2026-08-26T05:55:15.609493+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e64b054-63d2-4daa-b0e3-5f764bbcd848", "name": "gloomy-cosmic-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47582, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:55:10.566404+00:00", "ended_at": "2026-08-26T05:55:14.458288+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "49f21b05-5777-4c95-84bf-17450103a828", "name": "electric-restless-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47536, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:56.137357+00:00", "ended_at": "2026-08-26T05:55:00.583264+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4321f304-8fdb-438d-a153-52446561c62c", "name": "wooded-calm-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49364, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:51.013177+00:00", "ended_at": "2026-08-26T05:54:57.011735+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6e5cd0a6-1fba-4caf-85d2-cf423b84ff24", "name": "vaulted-vivid-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49294, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:49.886524+00:00", "ended_at": "2026-08-26T05:54:55.496017+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c75a2f5-70e7-4b69-b1e9-f6572ce37ed8", "name": "velvet-foggy-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52436, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:38.286837+00:00", "ended_at": "2026-08-26T05:54:42.487468+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "24862590-dda0-43b4-8400-03ccc604c20a", "name": "tangled-stoic-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53018, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:36.828663+00:00", "ended_at": "2026-08-26T05:54:43.049465+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2ce90a8d-9e5a-4c77-9778-af5e9e6c87f7", "name": "buoyant-cobalt-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52968, "username": "liyang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:29.763010+00:00", "ended_at": "2026-08-26T05:54:35.066729+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "00b0278b-5799-4f62-bf88-2666cc5ada86", "name": "balmy-crimson-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49114, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:23.978602+00:00", "ended_at": "2026-08-26T05:54:29.717000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dab359af-52c8-43e5-9948-ca2e4dc72d85", "name": "somber-russet-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49040, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:16.288105+00:00", "ended_at": "2026-08-26T05:54:19.486827+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f346e709-d76a-4c40-a839-846b84c4df13", "name": "vigilant-leafy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60184, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:15.821947+00:00", "ended_at": "2026-08-26T05:54:18.902856+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35948268-7c1b-4b22-8a1b-9a0e173a98d8", "name": "amiable-civil-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60138, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:06.535796+00:00", "ended_at": "2026-08-26T05:54:11.344828+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b55751a1-3741-4d65-89b9-0f3aa4447dab", "name": "frosty-supple-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37340, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:54:04.383338+00:00", "ended_at": "2026-08-26T05:54:09.697762+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f07b4c0a-132d-45ab-b24d-41795cb82993", "name": "civil-fearless-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36194, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:55.300726+00:00", "ended_at": "2026-08-26T05:54:00.489841+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b9ee32ff-4c04-4ee5-a0fd-cd0d6b082455", "name": "pristine-freckled-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36148, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:47.652744+00:00", "ended_at": "2026-08-26T05:53:52.592604+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b6aefb09-78b4-4288-bbc1-9de3090cbd80", "name": "bashful-thorny-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54324, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:42.023420+00:00", "ended_at": "2026-08-26T05:53:48.545575+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "1ad5dff4-fa0e-4147-a88d-b1cda949ab59", "name": "misty-lanky-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36900, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:38.580288+00:00", "ended_at": "2026-08-26T05:53:44.099056+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "17202afa-59fe-4885-a676-224bd42eb37a", "name": "autumn-hushed-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36980, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:37.872176+00:00", "ended_at": "2026-08-26T05:53:40.886990+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bca562a3-c652-4de6-b78b-18db54babf40", "name": "pewter-proud-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54258, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:27.143271+00:00", "ended_at": "2026-08-26T05:53:30.578322+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "67365a0e-9455-40ba-8e1f-a6f756d9cf3d", "name": "lawful-bashful-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38280, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:18.943317+00:00", "ended_at": "2026-08-26T05:53:24.512643+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2bee317-572f-41fa-8dce-ee40f4d1e9c5", "name": "autumn-flinty-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57158, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:18.678095+00:00", "ended_at": "2026-08-26T05:53:23.762007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6db4d3f6-f456-4c1e-a105-34a9103f8d71", "name": "quiet-shaded-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39684, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:08.046389+00:00", "ended_at": "2026-08-26T05:53:13.928756+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2f208036-63ab-4e9b-aa12-2180e0a79463", "name": "barren-vernal-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39752, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:07.590303+00:00", "ended_at": "2026-08-26T05:53:10.878691+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69a8a15a-5497-42c3-ae2c-4e87526e1aee", "name": "sandy-burly-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57082, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:53:07.400709+00:00", "ended_at": "2026-08-26T05:53:11.101617+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d37994c2-71d4-4c31-9acd-03253b5e4ae1", "name": "deft-salty-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50904, "username": "wso2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:53.898239+00:00", "ended_at": "2026-08-26T05:53:00.219675+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4e0056ea-ad47-4354-9035-d1f96e5c02e4", "name": "coastal-fleeting-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35392, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 276, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:50.128155+00:00", "ended_at": "2026-08-26T05:52:55.131825+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9cdea113-c8d0-4fa1-8364-6a0a84cf9cb9", "name": "loyal-rustic-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33276, "username": "Asalem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:37.819678+00:00", "ended_at": "2026-08-26T05:52:43.708197+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1e9f1739-ff85-4aaa-ae0c-048518c3ddf8", "name": "peaty-tranquil-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50854, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:33.029436+00:00", "ended_at": "2026-08-26T05:52:38.185523+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dbc73256-44ec-4bfd-ab65-1f3111ca55de", "name": "lonesome-tranquil-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33322, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:25.597024+00:00", "ended_at": "2026-08-26T05:52:28.335484+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "15e75850-2b35-4556-90e0-ddb2a2acb270", "name": "indigo-languid-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44148, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:19.746620+00:00", "ended_at": "2026-08-26T05:52:24.959890+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf4ac3d0-9fb8-4b8f-be4b-54c77c93baa8", "name": "craggy-wooded-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44082, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:11.525155+00:00", "ended_at": "2026-08-26T05:52:15.794366+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "17a37e54-82f7-470c-824c-080bc5dfbe7b", "name": "weathered-wistful-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34220, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:06.496484+00:00", "ended_at": "2026-08-26T05:52:09.354778+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "81b95909-6ab7-4418-bf26-20fb61008eab", "name": "merry-smoky-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53710, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:52:05.617512+00:00", "ended_at": "2026-08-26T05:52:10.910002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "65cd5e80-7566-439d-8ba6-b2956c8b9e16", "name": "dappled-lonesome-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53638, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:56.351643+00:00", "ended_at": "2026-08-26T05:52:02.106938+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a48e1bf2-1a19-4b52-9513-96de0eeb3a7f", "name": "murky-proud-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43046, "username": "hamed", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:51.943536+00:00", "ended_at": "2026-08-26T05:51:59.281202+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "f5b1ce25-dda0-40bb-a7a8-6a053e889408", "name": "knotted-amber-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43104, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:49.966553+00:00", "ended_at": "2026-08-26T05:51:54.266844+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad2e35e7-f9a9-4602-8244-f09296630b1b", "name": "noble-scarlet-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55706, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:37.704132+00:00", "ended_at": "2026-08-26T05:51:42.932507+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ec2efb35-32b0-446c-b7ca-34d2cb1afe2b", "name": "marine-jovial-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55640, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:31.589217+00:00", "ended_at": "2026-08-26T05:51:36.274109+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a54b7794-3485-464d-9a46-e7b22f3536e2", "name": "curious-merry-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:25.431091+00:00", "ended_at": "2026-08-26T05:51:28.334534+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "237e7151-1f0a-4bb9-ad3f-3a5df59b6588", "name": "rambling-breezy-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50196, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:24.225437+00:00", "ended_at": "2026-08-26T05:51:29.101207+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "148e76e1-5ef9-4207-83f3-3507d0065e7b", "name": "tangled-grumpy-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50112, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:21.654169+00:00", "ended_at": "2026-08-26T05:51:27.048293+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a794315f-3a7a-46bd-b4ba-c9f30424cbc3", "name": "watchful-honest-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38574, "username": "drcomadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:20.776201+00:00", "ended_at": "2026-08-26T05:51:25.800107+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "e45ff75c-25a9-439e-af4a-ca3f240870e8", "name": "sincere-russet-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38554, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:06.292890+00:00", "ended_at": "2026-08-26T05:51:11.737485+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "77d6619f-66eb-423f-9666-b68188b79f23", "name": "quaint-forlorn-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40718, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:02.931652+00:00", "ended_at": "2026-08-26T05:51:08.859045+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bee39122-7c19-4812-bc41-b3465e0340d7", "name": "merry-misty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40674, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:51:00.063700+00:00", "ended_at": "2026-08-26T05:51:02.746695+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e635640a-f4eb-4fba-a713-6b975c5d9b6e", "name": "painted-mottled-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40130, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:46.080653+00:00", "ended_at": "2026-08-26T05:50:49.175579+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b11ea1b-003e-42aa-babc-a4e516f484dc", "name": "weathered-vigilant-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55404, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:40.529307+00:00", "ended_at": "2026-08-26T05:50:44.587382+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e607c553-32db-4399-b288-bd250dc0b23d", "name": "vaulted-sandy-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56796, "username": "default", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:36.193150+00:00", "ended_at": "2026-08-26T05:50:44.314399+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "e27c29a0-a672-49be-842f-0ba6d994fa58", "name": "gleaming-lofty-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55376, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:32.270024+00:00", "ended_at": "2026-08-26T05:50:36.314648+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b968575e-caff-4a45-857e-07be0ec9abef", "name": "balmy-whispering-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42692, "username": "rancher", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:30.144770+00:00", "ended_at": "2026-08-26T05:50:37.998541+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "a2326865-7534-4aa9-a250-18aca05f5481", "name": "keen-foggy-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42774, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:29.949076+00:00", "ended_at": "2026-08-26T05:50:35.123603+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f1dfe927-83d9-4153-885e-83bea5fce319", "name": "twilight-autumn-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56762, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:19.119581+00:00", "ended_at": "2026-08-26T05:50:23.284167+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e6b0b05e-3776-44c5-9df8-f34bfbd22c90", "name": "frosty-boreal-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39516, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:15.025516+00:00", "ended_at": "2026-08-26T05:50:18.687878+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4abe845e-d974-4074-87d7-7a355b46199f", "name": "wooded-supple-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39542, "username": "daniel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:05.068530+00:00", "ended_at": "2026-08-26T05:50:10.470471+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "bf370873-4138-4144-9d0d-b45523682ab0", "name": "solar-vaulted-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50668, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:03.170129+00:00", "ended_at": "2026-08-26T05:50:05.886077+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d99bda9-73c8-4c8c-8368-1ccddfa65b8a", "name": "northern-cobalt-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39476, "username": "omm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:50:02.184149+00:00", "ended_at": "2026-08-26T05:50:05.089118+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "3192b712-5b07-4a9d-8b1b-2cc8d0dfb156", "name": "mellow-wry-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50606, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:53.417969+00:00", "ended_at": "2026-08-26T05:49:58.319156+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3a4396d-c4af-4700-9f32-372baf95d517", "name": "shaded-twilight-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45116, "username": "kevin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:52.813035+00:00", "ended_at": "2026-08-26T05:49:56.168703+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "5aafd87c-7640-4376-8069-99bc2008f158", "name": "fickle-icy-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42992, "username": "admins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:38.412266+00:00", "ended_at": "2026-08-26T05:49:42.187647+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "065d95a6-e5e2-481a-ab06-061a3f4616f3", "name": "frugal-noble-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45038, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:34.760268+00:00", "ended_at": "2026-08-26T05:49:38.896938+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e10f7bca-7a50-46f6-bdba-26900ddb7a92", "name": "emerald-dusty-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42940, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:34.495696+00:00", "ended_at": "2026-08-26T05:49:42.110749+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1001a9e9-1aa2-4600-bbfe-579d5a0284f4", "name": "quiet-silent-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57088, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:15.695304+00:00", "ended_at": "2026-08-26T05:49:18.977210+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2c3824c-8e95-4d5e-ba30-a0991e77804c", "name": "buoyant-crystal-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33204, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:14.942183+00:00", "ended_at": "2026-08-26T05:49:20.503713+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e5447e0-6cf3-40a5-995e-6ba69d6fd57d", "name": "dewy-idle-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54824, "username": "ark", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:09.080963+00:00", "ended_at": "2026-08-26T05:49:12.970115+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "6ca1e05c-abc7-48c2-85a6-ee238e34e9a2", "name": "ruddy-plucky-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54730, "username": "kelly", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:49:07.934808+00:00", "ended_at": "2026-08-26T05:49:14.120163+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "fb4456f2-db4c-477d-955f-e80e05d59a34", "name": "hearty-jolly-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33594, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:52.712146+00:00", "ended_at": "2026-08-26T05:48:57.112709+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "97911f2d-d615-4989-a3ee-842d4134f0e5", "name": "quaint-gleaming-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33556, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:46.442449+00:00", "ended_at": "2026-08-26T05:48:52.098120+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "497c27c1-ff94-41d9-b5e8-39e4233441bf", "name": "crisp-misty-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36990, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:42.402694+00:00", "ended_at": "2026-08-26T05:48:47.648106+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2c96d18a-7c71-4f52-bb83-89a5dbbcac91", "name": "frugal-blithe-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36958, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:34.959325+00:00", "ended_at": "2026-08-26T05:48:39.880616+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2588ae26-b9e8-4ccb-8395-d354c91c1b3f", "name": "fickle-pewter-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46184, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:29.399499+00:00", "ended_at": "2026-08-26T05:48:32.400746+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "709b886a-7d2a-4405-849d-975a7cd24389", "name": "blithe-diligent-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37830, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:28.235073+00:00", "ended_at": "2026-08-26T05:48:32.671840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28c7f4fc-4cb9-497b-bf7c-adb4b1a7bc50", "name": "lofty-salty-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37776, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:20.100999+00:00", "ended_at": "2026-08-26T05:48:25.772456+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee83e7d6-1480-429c-93a3-b1c0b8f1510b", "name": "gallant-stoic-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39224, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:17.376154+00:00", "ended_at": "2026-08-26T05:48:23.399594+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "880223ae-acd6-42fd-8ee8-d9dab3be25ad", "name": "thrifty-russet-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39292, "username": "usuario", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:12.199470+00:00", "ended_at": "2026-08-26T05:48:18.908204+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "250e7e3c-a16a-4e70-8aff-ae4788cb9eb7", "name": "hidden-forlorn-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54214, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:48:01.205817+00:00", "ended_at": "2026-08-26T05:48:07.587175+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4846c89a-3bf0-434a-ab0f-6228840800f2", "name": "languid-mottled-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39094, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:56.314068+00:00", "ended_at": "2026-08-26T05:48:01.737604+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "19f25e96-4d56-43fd-bfef-abc7f2d12117", "name": "emerald-lonesome-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39040, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:52.544378+00:00", "ended_at": "2026-08-26T05:47:58.145631+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "48b10048-db83-496d-b1b1-d82579569c38", "name": "steady-rustic-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40888, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:42.691298+00:00", "ended_at": "2026-08-26T05:47:45.343499+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e7282771-6a83-4fd7-8b74-41bb8a70ede5", "name": "painted-coastal-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 54186, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:42.414262+00:00", "ended_at": "2026-08-26T05:47:47.492257+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d3ae854-3403-4956-acaa-279a5afc8761", "name": "tidal-humble-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42162, "username": "Caps", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:36.138426+00:00", "ended_at": "2026-08-26T05:47:41.717072+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "1b4e3b22-1109-4a33-aa18-533de8e0f0aa", "name": "painted-weathered-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42210, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:31.730313+00:00", "ended_at": "2026-08-26T05:47:34.379366+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bfb5d689-3ef0-4c84-a4a1-6a47f57504d2", "name": "whispering-western-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45528, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:31.209423+00:00", "ended_at": "2026-08-26T05:47:36.817996+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a3d1a006-ae86-4661-9418-4e0a0aca9b03", "name": "breezy-downy-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45488, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 180, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:19.549882+00:00", "ended_at": "2026-08-26T05:47:24.811305+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74526c11-02f0-421e-bc64-60a9b9ce3ee7", "name": "gilded-glacial-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.143.238.100", "src_port": 53956, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T05:47:19.457008+00:00", "ended_at": "2026-08-26T05:47:19.533615+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3807 }, { "id": "efb1e87e-4274-4d0c-bcc4-c9cf52cb62da", "name": "dewy-coral-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35332, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:09.002939+00:00", "ended_at": "2026-08-26T05:47:14.228632+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "031b7239-19bb-40c4-93e9-943e4359d91d", "name": "fickle-solemn-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35266, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:06.943304+00:00", "ended_at": "2026-08-26T05:47:10.082638+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9d0a3037-7aea-445b-a652-dc3261e53dc5", "name": "humble-balmy-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34542, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:03.047432+00:00", "ended_at": "2026-08-26T05:47:07.194147+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "616ab5be-ea0c-47f6-9561-abfdb69d7af7", "name": "hazy-craggy-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34106, "username": "coder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:47:02.099650+00:00", "ended_at": "2026-08-26T05:47:09.468834+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "053c6a5f-3d26-4b4b-a123-0d012f0c9ee5", "name": "quartz-drifting-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 34058, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:54.867105+00:00", "ended_at": "2026-08-26T05:46:59.510612+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "5c472553-b457-4dc5-9e4a-1680c1d3304b", "name": "vaulted-honest-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59218, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:40.336332+00:00", "ended_at": "2026-08-26T05:46:44.686890+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "be97c49e-916c-4b1f-a927-9a9ac2b6362e", "name": "opal-tawny-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43890, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:36.855684+00:00", "ended_at": "2026-08-26T05:46:40.837968+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "64db4926-52f1-415f-9483-77c584035e63", "name": "gritty-wandering-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43984, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:32.014157+00:00", "ended_at": "2026-08-26T05:46:36.111454+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49267bed-a02f-4a6a-8e68-24c53c5aacc4", "name": "canny-rugged-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 32888, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:30.592321+00:00", "ended_at": "2026-08-26T05:46:38.883526+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "8527892a-bace-47d3-b566-fe642e4e111a", "name": "shaded-polar-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36132, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:18.863880+00:00", "ended_at": "2026-08-26T05:46:22.906688+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9be8787e-f229-4399-8320-618b1a86ad07", "name": "quiet-nimble-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 32836, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:15.693051+00:00", "ended_at": "2026-08-26T05:46:18.565700+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a453c07f-5826-43fd-a43f-da083e31bc33", "name": "sturdy-silent-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36082, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:12.234376+00:00", "ended_at": "2026-08-26T05:46:18.115642+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ec75da62-6bb4-4d7b-8fd1-ee756cfa3123", "name": "lunar-cobalt-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 32948, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:07.425273+00:00", "ended_at": "2026-08-26T05:46:12.679477+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "19597fdb-6c0d-4cc0-9242-850eb1cf073f", "name": "coral-early-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 32988, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:46:01.673778+00:00", "ended_at": "2026-08-26T05:46:05.589504+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b33b6bea-fae1-44d4-abc9-488de92a37dc", "name": "merry-bitter-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44986, "username": "esroot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:49.884110+00:00", "ended_at": "2026-08-26T05:45:55.263755+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0f8bb2fe-cab4-4c42-8a77-7804a83598e2", "name": "sturdy-cobalt-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60894, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:49.839582+00:00", "ended_at": "2026-08-26T05:45:55.419666+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f2edaa2c-bd4c-472a-915e-1a65412440b3", "name": "golden-hazel-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53644, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 179, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:34.000062+00:00", "ended_at": "2026-08-26T05:45:39.995920+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8a1cfbe3-7736-404a-8c86-0048a8d9a80c", "name": "dappled-courtly-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53584, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:26.114115+00:00", "ended_at": "2026-08-26T05:45:31.411871+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4787045d-65f1-4aa7-a2c5-8175f1721765", "name": "tangled-jolly-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45108, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:18.627383+00:00", "ended_at": "2026-08-26T05:45:23.712801+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7144f95e-0eda-4f57-99bc-65cab7323618", "name": "mindful-lanky-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45062, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:16.640327+00:00", "ended_at": "2026-08-26T05:45:21.662439+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ea2d4df-c299-44c8-9c05-64a31488a35b", "name": "nimble-northern-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59652, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:09.610545+00:00", "ended_at": "2026-08-26T05:45:17.538185+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "06cb1967-32ed-44c7-8726-80effb942e4b", "name": "reedy-gilded-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59702, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:45:07.739472+00:00", "ended_at": "2026-08-26T05:45:10.555789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "565096a3-750a-42bc-9ab4-dc279fbb6e1c", "name": "bashful-icy-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39170, "username": "aiuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:58.915010+00:00", "ended_at": "2026-08-26T05:45:05.618346+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4b3b9c7f-dd6d-425a-9909-0ca879dbaa3d", "name": "curious-thrifty-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43402, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:58.836926+00:00", "ended_at": "2026-08-26T05:45:03.580772+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9630ee3-2ccf-40ce-bd93-ce16e4212155", "name": "brisk-gentle-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53738, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:50.651310+00:00", "ended_at": "2026-08-26T05:44:54.615193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a94e68b8-27c5-4190-a3ad-6849c26669c2", "name": "hazel-rustic-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53814, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:47.858498+00:00", "ended_at": "2026-08-26T05:44:51.806795+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee2b45d5-9246-4cc2-a535-1540351b06c2", "name": "wry-patient-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39058, "username": "vagrant", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:42.644612+00:00", "ended_at": "2026-08-26T05:44:49.514002+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "9e3304f4-813f-40cb-9807-c018b211d3bb", "name": "crystal-valiant-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55492, "username": "elrond", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:36.318903+00:00", "ended_at": "2026-08-26T05:44:42.093876+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "aaea2f0d-db24-415c-b869-323b7bb4cbce", "name": "grumpy-lucid-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52490, "username": "fahmi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:23.559507+00:00", "ended_at": "2026-08-26T05:44:28.939809+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "5326e721-88e3-4a45-ae42-308c5fbbd714", "name": "orderly-loyal-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50198, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:14.386633+00:00", "ended_at": "2026-08-26T05:44:21.204797+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "dd6d5e85-1073-4db0-8780-f3f23fb2639e", "name": "zealous-wistful-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 50250, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:07.891323+00:00", "ended_at": "2026-08-26T05:44:11.557144+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0c715d12-9a69-4150-8952-1903b7b525a4", "name": "velvet-burly-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55194, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 303, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:03.954690+00:00", "ended_at": "2026-08-26T05:44:09.424425+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "3c8f1204-030d-414e-8a2f-f31b83fb31ab", "name": "burly-lunar-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47994, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:44:01.816236+00:00", "ended_at": "2026-08-26T05:44:07.777649+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8a8fc5e-e783-406b-8384-84af4df73983", "name": "supple-peaty-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47968, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:51.311089+00:00", "ended_at": "2026-08-26T05:43:54.043147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "21ac6372-f49e-48ef-9c83-9f37849b8245", "name": "graceful-nameless-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51364, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:43.991251+00:00", "ended_at": "2026-08-26T05:43:50.983807+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f5f438f8-bd9d-4faf-973b-7c18f3767475", "name": "jovial-cosmic-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51396, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:43.638691+00:00", "ended_at": "2026-08-26T05:43:49.641475+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "e1ce8f75-060c-43ee-949a-db99e0c980a4", "name": "glassy-barren-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55184, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:40.696177+00:00", "ended_at": "2026-08-26T05:43:45.578952+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dff42439-0f66-4372-ae50-1bf18531e6f2", "name": "nameless-hushed-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 33900, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:32.011191+00:00", "ended_at": "2026-08-26T05:43:36.718800+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d93f2f53-6800-4e8b-a182-7ff66495167c", "name": "faded-languid-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40510, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:26.833597+00:00", "ended_at": "2026-08-26T05:43:34.983096+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "46725d27-f028-463e-a316-c56cca53e982", "name": "tangled-hardy-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40554, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:21.448720+00:00", "ended_at": "2026-08-26T05:43:26.498099+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03d58167-0e86-464a-9358-3125b9a7a5c9", "name": "kindly-freckled-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39054, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:09.479263+00:00", "ended_at": "2026-08-26T05:43:17.185606+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "ecf901d3-57f0-4230-9d5a-66feaa83295d", "name": "spirited-mossy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39126, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:43:08.538471+00:00", "ended_at": "2026-08-26T05:43:14.458007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e56a5c8c-900f-44e7-9a94-e708555cdfc6", "name": "boreal-thrifty-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 46006, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:50.231101+00:00", "ended_at": "2026-08-26T05:42:55.096134+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2350562-7cb5-4852-9b7b-fdb70ffed129", "name": "sleepy-forlorn-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45962, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:47.413013+00:00", "ended_at": "2026-08-26T05:42:52.366618+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f00a1ef1-6f93-4b67-8ef2-8992042b74dc", "name": "sooty-smoky-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45692, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:46.719965+00:00", "ended_at": "2026-08-26T05:42:52.681446+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "823b4cff-55e1-4a18-8c7a-d21e2a3ae8ce", "name": "downy-tranquil-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55390, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:40.189191+00:00", "ended_at": "2026-08-26T05:42:46.454759+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f97a865d-84f1-48c9-8835-ebc6625bb7ac", "name": "rapid-placid-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45614, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:29.772811+00:00", "ended_at": "2026-08-26T05:42:35.365549+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "734acd6d-204c-45b2-b268-a83426ae521a", "name": "murky-cobalt-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55512, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:29.768351+00:00", "ended_at": "2026-08-26T05:42:36.655598+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2670b477-ae09-47b6-94b5-671c2af40270", "name": "umber-lawful-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42616, "username": "dspace", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:21.758345+00:00", "ended_at": "2026-08-26T05:42:29.670963+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c61f5105-aa95-446e-a89f-c3ff69a78207", "name": "windswept-wry-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55466, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:15.016864+00:00", "ended_at": "2026-08-26T05:42:18.204069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "61f67c31-6c3b-4606-bc58-756c20cceade", "name": "tawny-meadow-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42560, "username": "vbox", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:13.983030+00:00", "ended_at": "2026-08-26T05:42:21.792041+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "445ee017-a27d-4192-a96c-ddfe800b5b4f", "name": "merry-murky-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56254, "username": "christianna", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:04.661154+00:00", "ended_at": "2026-08-26T05:42:12.015059+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "857f7ca7-6263-43f0-98ce-a3cbd94c05ae", "name": "jolly-cheerful-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56246, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:00.970532+00:00", "ended_at": "2026-08-26T05:42:08.976720+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "eda2fb8d-e96f-4d1d-9d3b-6fae6ecf3601", "name": "glassy-balmy-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48046, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:42:00.096078+00:00", "ended_at": "2026-08-26T05:42:06.199009+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "4737ef6e-aa32-4900-9ba1-12f375190ab9", "name": "blunt-golden-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40288, "username": "clawdbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:43.861064+00:00", "ended_at": "2026-08-26T05:41:51.651270+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "0a693fbc-ac19-4ee3-98ff-a3da03de5935", "name": "slender-snowy-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48004, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:43.708336+00:00", "ended_at": "2026-08-26T05:41:46.551446+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69caa988-bfeb-431f-a0ed-68b0eb754e68", "name": "electric-windswept-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38480, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:37.621392+00:00", "ended_at": "2026-08-26T05:41:40.807390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d6e405e-4e50-4f91-a908-be818b85bc04", "name": "salty-fringed-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51342, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:31.521310+00:00", "ended_at": "2026-08-26T05:41:38.314073+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "e1041efa-7d4b-48e1-802b-61fd60df4c98", "name": "honest-smooth-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40236, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:29.770295+00:00", "ended_at": "2026-08-26T05:41:34.137622+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b6e8b69-4d32-49c0-91e6-2c45ff8960b2", "name": "inland-mighty-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51254, "username": "playground", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:25.254818+00:00", "ended_at": "2026-08-26T05:41:30.684999+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "c9286140-5da1-4be8-b7d9-d6116f1cdd26", "name": "serene-rustic-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57164, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:17.519112+00:00", "ended_at": "2026-08-26T05:41:22.726999+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "914b2cf1-af88-4237-bb9d-c3f46f4befd4", "name": "mossy-smooth-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57124, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:41:05.856411+00:00", "ended_at": "2026-08-26T05:41:11.816745+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3da12d0-d9c0-467a-af2a-5595dddadd92", "name": "watchful-graceful-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57982, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:56.715268+00:00", "ended_at": "2026-08-26T05:41:00.432233+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fead4236-c05a-4cc2-8439-aad69a9893b4", "name": "salty-plucky-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60294, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:53.952390+00:00", "ended_at": "2026-08-26T05:40:57.113817+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ba526a5-1826-4cae-aaab-a58c7df44868", "name": "gritty-hazel-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37094, "username": "kipt", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:51.612334+00:00", "ended_at": "2026-08-26T05:40:57.491559+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "d0597f92-13c0-479d-ab86-9414bb85c883", "name": "emerald-reedy-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 60380, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:47.538384+00:00", "ended_at": "2026-08-26T05:40:50.375899+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "44f766b0-2fb8-442b-890b-b238b5fdf44f", "name": "fierce-pristine-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37028, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:39.939940+00:00", "ended_at": "2026-08-26T05:40:42.870518+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37639a5f-dd41-44f5-9634-a8c25c35c558", "name": "brazen-diligent-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35600, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:36.026938+00:00", "ended_at": "2026-08-26T05:40:43.300150+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "163cc4ac-722d-492a-b0b2-6eb950502f1b", "name": "alpine-pleasant-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49878, "username": "t1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:21.943764+00:00", "ended_at": "2026-08-26T05:40:28.518147+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "d39b9cb8-2f35-4972-942a-eedec460c754", "name": "valiant-dappled-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 49894, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:18.571036+00:00", "ended_at": "2026-08-26T05:40:21.189730+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c48b7b97-7352-4ebf-a880-d14f15519665", "name": "kindly-dapper-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56534, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:15.179262+00:00", "ended_at": "2026-08-26T05:40:23.149708+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "75dfa8e8-9c19-4cbf-afe2-7d8ec3629076", "name": "nameless-bitter-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 56482, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:15.142179+00:00", "ended_at": "2026-08-26T05:40:20.382135+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "5ff22774-bdc2-4d71-8366-05dc23348806", "name": "solar-vaulted-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 36058, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:40:00.740059+00:00", "ended_at": "2026-08-26T05:40:06.795742+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69f6b504-777d-4720-8226-4e40a0ada1a3", "name": "painted-craggy-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58006, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:53.807747+00:00", "ended_at": "2026-08-26T05:40:00.868570+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "fe479732-f246-403f-85e8-648acbad2e99", "name": "noble-russet-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58072, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:48.942007+00:00", "ended_at": "2026-08-26T05:39:54.269610+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef48d493-bc9a-4704-ad1c-f05c04364185", "name": "alpine-ancient-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59944, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:47.389239+00:00", "ended_at": "2026-08-26T05:39:53.246913+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "40aacefe-059c-4142-81b2-1360b9bf5fd5", "name": "blazing-keen-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:44.924888+00:00", "ended_at": "2026-08-26T05:39:49.044494+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "af850ea0-93d0-4171-93ae-d6388cfb24e1", "name": "lucid-wiry-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48920, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:39.589796+00:00", "ended_at": "2026-08-26T05:39:45.071288+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "0c11d438-15f7-45b3-b8d5-7381bd2930bb", "name": "meadow-inland-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48880, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:35.800192+00:00", "ended_at": "2026-08-26T05:39:41.788114+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "cd4dea40-ce09-4cf5-87cb-c1b5f4cc5375", "name": "drifting-grumpy-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:24.899032+00:00", "ended_at": "2026-08-26T05:39:29.265002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45408ca5-3b4d-43f7-8b5b-a48604c1264d", "name": "wry-sterling-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57808, "username": "sedu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:21.665338+00:00", "ended_at": "2026-08-26T05:39:27.664653+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "673f9704-242d-4a2c-8c59-5a96d42da402", "name": "scarlet-clever-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39512, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:39:05.021574+00:00", "ended_at": "2026-08-26T05:39:10.311318+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c7da5e39-92b4-40cb-971d-7106984f7c86", "name": "loyal-drifting-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44730, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:58.347738+00:00", "ended_at": "2026-08-26T05:39:03.847296+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "fbf34ca5-20a7-4e6e-9012-ec761c9a50e5", "name": "gilded-serene-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44654, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:52.814143+00:00", "ended_at": "2026-08-26T05:38:59.792949+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "fd1ce6b1-6840-497d-a6c6-4439d1fe6ebd", "name": "rugged-crystal-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 39448, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:52.705348+00:00", "ended_at": "2026-08-26T05:38:57.598230+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11aecdfb-390d-4004-95e5-bad6e4319540", "name": "proud-wiry-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43520, "username": "monitor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:38.360289+00:00", "ended_at": "2026-08-26T05:38:44.519898+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "4895e785-629e-42d3-b7fa-97edd5f2d13b", "name": "bronzed-quartz-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43430, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:36.849318+00:00", "ended_at": "2026-08-26T05:38:43.262900+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c07cce18-d8b2-4942-b5be-c2476fc58d1b", "name": "daring-mottled-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59926, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:33.502322+00:00", "ended_at": "2026-08-26T05:38:40.362146+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1671 }, { "id": "f01d3198-91f2-4b4a-94ae-6997095af8cf", "name": "umber-rapid-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59916, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:25.380931+00:00", "ended_at": "2026-08-26T05:38:30.319249+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "380691c0-5586-4b14-ba62-b21e06bf5623", "name": "meadow-rambling-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45820, "username": "joel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:21.282011+00:00", "ended_at": "2026-08-26T05:38:27.189776+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "72bb9e10-c636-4d09-9ad9-94981ecd37ec", "name": "slender-emerald-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 45786, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:12.710253+00:00", "ended_at": "2026-08-26T05:38:20.504741+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "878dbc6b-5817-4174-bae3-db3583e9ae74", "name": "curious-diligent-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51522, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:38:09.816270+00:00", "ended_at": "2026-08-26T05:38:17.850530+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "365217b5-192d-4855-a157-576ea5c1e39f", "name": "tranquil-breezy-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51476, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:53.990078+00:00", "ended_at": "2026-08-26T05:37:58.892438+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e9f5a7dd-381a-4f56-81ef-6bedef288c01", "name": "marbled-hazel-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52814, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:47.626905+00:00", "ended_at": "2026-08-26T05:37:53.558104+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae380774-294c-4d2a-b120-dc34b5d5021a", "name": "restless-tidal-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52268, "username": "config", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 181, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:47.427615+00:00", "ended_at": "2026-08-26T05:37:52.812719+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "67fcc794-c310-4a65-9645-2744da6ce878", "name": "fringed-meadow-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57272, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:43.912788+00:00", "ended_at": "2026-08-26T05:37:49.839250+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "3cee41e3-bac6-4e67-93a5-d59c25e38410", "name": "distant-sandy-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 57288, "username": "bitrix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:37.560103+00:00", "ended_at": "2026-08-26T05:37:43.336524+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "3481d877-4c26-4dab-8bc3-53374b58aae5", "name": "burly-cunning-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53764, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:28.125020+00:00", "ended_at": "2026-08-26T05:37:35.172708+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "3c68236f-3304-47b8-b509-bfcf16b28475", "name": "sterling-graceful-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 53730, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:21.570017+00:00", "ended_at": "2026-08-26T05:37:26.568826+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "c1b16e9c-28a6-4f26-ba7c-73d03bb07b5d", "name": "seaward-scarlet-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40512, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:10.160818+00:00", "ended_at": "2026-08-26T05:37:14.726795+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3e12c80-3198-412e-a3d3-55c2289563f0", "name": "restless-crisp-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 40472, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:06.463900+00:00", "ended_at": "2026-08-26T05:37:11.963013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d0b57348-aa21-46ad-9ade-8d6e23c72310", "name": "stoic-velvet-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51116, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:37:05.775487+00:00", "ended_at": "2026-08-26T05:37:12.014933+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5f4d3771-9913-4b3c-b28d-d2b134f39f18", "name": "gleaming-sooty-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 51182, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 175, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:56.386993+00:00", "ended_at": "2026-08-26T05:36:59.196659+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2dd2ffa3-1cf4-44ff-8fcc-53f2cf2ef397", "name": "supple-noble-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42518, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 175, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:51.461390+00:00", "ended_at": "2026-08-26T05:36:55.329442+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a82e0317-dcf2-4d8e-9dce-880af0c75a6c", "name": "cobalt-cosmic-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42592, "username": "sdadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:47.227815+00:00", "ended_at": "2026-08-26T05:36:54.685435+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "cc557f1c-d216-4b59-8f53-baceb6bdfcdb", "name": "idle-gentle-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 59406, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:39.970227+00:00", "ended_at": "2026-08-26T05:36:44.881483+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7c0f2e0f-72bd-4cf1-9809-310ca893b19b", "name": "spirited-plucky-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42690, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:33.417936+00:00", "ended_at": "2026-08-26T05:36:37.313563+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2dc5109f-ddec-4180-b024-34fa60a6b90f", "name": "steady-lofty-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35894, "username": "parsa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:31.688703+00:00", "ended_at": "2026-08-26T05:36:39.327625+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "14a0d4f2-2c3e-442e-87e9-07cdd74cc58b", "name": "glassy-candid-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 35872, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:26.056521+00:00", "ended_at": "2026-08-26T05:36:30.955841+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "c7b1c170-d4fb-4c7f-9bc0-ddafeb65b55b", "name": "fierce-salty-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 42618, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:23.380209+00:00", "ended_at": "2026-08-26T05:36:28.634404+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90c8d188-5e1c-4666-87f6-c39fdd08d908", "name": "calm-kindly-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55852, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:18.964873+00:00", "ended_at": "2026-08-26T05:36:24.846841+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "fce7a490-bfeb-4c15-9e10-1f7053b286e2", "name": "northern-hollow-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55802, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:36:14.669440+00:00", "ended_at": "2026-08-26T05:36:20.187504+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "b41a125c-0319-49b4-aaee-03da6b8e0086", "name": "upland-idle-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58168, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:35:58.987506+00:00", "ended_at": "2026-08-26T05:36:03.046475+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0e1edd36-1385-452f-a2c6-e614545e95a8", "name": "calm-upland-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 58100, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 181, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:35:49.467875+00:00", "ended_at": "2026-08-26T05:35:55.410016+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef2db104-6797-40f1-b5d0-cde1dfe1cbda", "name": "mindful-marine-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:35:31.852411+00:00", "ended_at": "2026-08-26T05:35:36.176529+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9207aaf1-0289-4cec-a95e-1d73aafe447d", "name": "rustic-courtly-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52040, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:35:20.088835+00:00", "ended_at": "2026-08-26T05:35:25.833882+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7528d8eb-9819-4e1f-835b-8b2114487cb8", "name": "seaward-quaint-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 52004, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:35:10.356796+00:00", "ended_at": "2026-08-26T05:35:17.953701+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "47711797-3589-48a1-a447-0732561e8207", "name": "dusky-polar-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55228, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:59.873073+00:00", "ended_at": "2026-08-26T05:35:01.600813+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3fb7224f-ce72-432c-9a23-52b6f6fa9888", "name": "shaded-austere-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 55174, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:55.754253+00:00", "ended_at": "2026-08-26T05:34:57.946458+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "660ba7be-cb59-4cef-b168-343ef912537e", "name": "tranquil-boreal-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38764, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:53.568268+00:00", "ended_at": "2026-08-26T05:34:58.182088+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "30f7799d-8b01-4121-8267-3b1612f01727", "name": "gleaming-weathered-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44258, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:41.496802+00:00", "ended_at": "2026-08-26T05:34:42.800514+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7250dd0-aa35-4f19-8469-d0e87d108868", "name": "regal-genial-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 44210, "username": "packer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:39.678217+00:00", "ended_at": "2026-08-26T05:34:42.951188+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0da614ed-9ed9-40d5-bfb6-d9a936ec52fd", "name": "tranquil-regal-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48302, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:34.176130+00:00", "ended_at": "2026-08-26T05:34:37.618490+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ba724df8-2bc2-4107-bce1-53b3f8f73d94", "name": "muted-crimson-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48190, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:30.951028+00:00", "ended_at": "2026-08-26T05:34:34.076474+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "75f69e2a-c979-4a48-9795-fab9f83d0dae", "name": "patient-gloomy-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 38166, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:17.637609+00:00", "ended_at": "2026-08-26T05:34:19.094464+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a86d34b9-491d-4593-801d-dba8a784646b", "name": "vernal-wistful-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47880, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:15.367163+00:00", "ended_at": "2026-08-26T05:34:19.467968+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "64183590-5380-491a-98a4-7cff313eb3f7", "name": "tender-jolly-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47820, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:34:08.383104+00:00", "ended_at": "2026-08-26T05:34:13.175509+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5fa12cea-250e-4b07-bcf6-458bd96ad266", "name": "cobalt-distant-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43460, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 409, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:33:57.712148+00:00", "ended_at": "2026-08-26T05:34:01.881469+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b911b451-db65-4594-9c14-d028196b1a31", "name": "austere-brisk-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 43408, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 577, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:33:53.713060+00:00", "ended_at": "2026-08-26T05:33:57.714228+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "c5eb228f-6486-4557-962d-0b26fbb42ae2", "name": "lawful-flinty-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 47326, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 651, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:33:46.858327+00:00", "ended_at": "2026-08-26T05:33:51.876749+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "a34cff21-3be1-4e83-b395-d50d8d8e0387", "name": "wandering-proud-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37880, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 853, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:33:42.282895+00:00", "ended_at": "2026-08-26T05:33:46.235141+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "1740f524-7f41-4d5d-8e10-0b72f948dbc7", "name": "dewy-umber-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 37782, "username": "reza", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 1052, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:33:33.990257+00:00", "ended_at": "2026-08-26T05:33:39.790362+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "94c30bc0-f6eb-48f2-96d8-2c761a20894d", "name": "inland-keen-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.40.200", "src_port": 48708, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 988, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-26T05:33:26.426077+00:00", "ended_at": "2026-08-26T05:33:33.815448+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "c0f1f91f-14eb-443c-927e-66e77cd79df1", "name": "golden-genial-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.224.160", "src_port": 56948, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 648, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T05:01:27.203810+00:00", "ended_at": "2026-08-26T05:01:27.406284+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3963 }, { "id": "52410695-7896-42a0-809a-b9628451fec4", "name": "idle-nautical-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 59408, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:48:09.793342+00:00", "ended_at": "2026-08-26T02:48:09.904890+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8befaa8e-1910-4dc4-a702-1ab21a1e4571", "name": "gallant-weathered-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 57876, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:46:27.571249+00:00", "ended_at": "2026-08-26T02:46:27.678085+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a8e83eeb-6f2d-4f39-811f-9302d82963dc", "name": "vernal-creaky-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 56366, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:45:08.446637+00:00", "ended_at": "2026-08-26T02:45:08.579278+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "62fb1f85-f325-447c-b898-5fdd3aa7367e", "name": "austere-proud-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 54810, "username": "weblogic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:43:58.359243+00:00", "ended_at": "2026-08-26T02:43:58.722668+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e6eb07f1-0037-47c0-8c6d-a8c798f22eaa", "name": "civil-frank-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 53286, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:42:53.026495+00:00", "ended_at": "2026-08-26T02:42:53.145011+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "10f1ac72-27f5-4c11-9342-72f71607fbf8", "name": "tawny-jaunty-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 51752, "username": "nagios", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:41:41.232964+00:00", "ended_at": "2026-08-26T02:41:42.002194+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "446448a2-28f5-431a-ae10-900c531dccdd", "name": "fabled-quiet-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 50194, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:40:35.326465+00:00", "ended_at": "2026-08-26T02:40:35.454711+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3518569f-9986-43f0-8ae3-0814b04b1889", "name": "jolly-craggy-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 48640, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:39:21.691360+00:00", "ended_at": "2026-08-26T02:39:21.797772+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "aea5a59b-6f79-4c5a-bf3e-0d4aac96451e", "name": "seaward-sleepy-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 47052, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:38:04.049195+00:00", "ended_at": "2026-08-26T02:38:04.222536+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "829db887-f85c-4734-925e-84ce30031233", "name": "plucky-twilight-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 45504, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:36:04.831869+00:00", "ended_at": "2026-08-26T02:36:04.957546+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f2a485f5-0bc2-4716-aaa2-b406295aa045", "name": "blazing-honest-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 43960, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:34:26.385399+00:00", "ended_at": "2026-08-26T02:34:26.506202+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7577ae98-1bfd-4f43-8dd6-db6bd6e061ef", "name": "curious-frugal-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 42412, "username": "yuanwd", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:33:08.912896+00:00", "ended_at": "2026-08-26T02:33:09.046614+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "786683db-9b2d-44d4-ae6b-ecff9b8e3c09", "name": "nautical-frank-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 40854, "username": "pul", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:32:00.674233+00:00", "ended_at": "2026-08-26T02:32:00.787419+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5a22f683-8682-474f-8a34-ead4dc9738d1", "name": "ivory-flinty-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 39310, "username": "zhouh", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:30:49.959053+00:00", "ended_at": "2026-08-26T02:30:50.069880+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4b662dad-f724-46cf-999d-dad634792a38", "name": "nameless-subtle-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 37768, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:29:40.057386+00:00", "ended_at": "2026-08-26T02:29:40.171545+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "24b834cd-9544-480a-9127-403899348483", "name": "noble-nimble-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 36214, "username": "uftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:28:30.159476+00:00", "ended_at": "2026-08-26T02:28:30.267812+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "86280427-f426-474a-a213-fd6342fc1fb8", "name": "alpine-thorny-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 34658, "username": "vps", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:27:19.724120+00:00", "ended_at": "2026-08-26T02:27:19.833824+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1976d68f-4cdc-441c-9d95-d13b534e5b19", "name": "lofty-jovial-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 33074, "username": "jira", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:26:05.863261+00:00", "ended_at": "2026-08-26T02:26:05.979647+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e87715a0-5e7f-4981-b556-6abdbae450aa", "name": "sooty-wandering-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 59716, "username": "wpyan", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:24:46.581988+00:00", "ended_at": "2026-08-26T02:24:46.685128+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1ed0243e-f9e6-444a-980f-219ccbafbaa0", "name": "feral-alpine-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 58144, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:23:35.188139+00:00", "ended_at": "2026-08-26T02:23:35.292695+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b9d14717-ed11-414e-976a-6805de3f824c", "name": "boreal-shaded-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 56536, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:22:18.794280+00:00", "ended_at": "2026-08-26T02:22:18.988262+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d9630b01-75c1-4a03-a469-479ad6dd79f7", "name": "diligent-somber-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 54826, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:20:55.757647+00:00", "ended_at": "2026-08-26T02:20:55.870769+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fc16ac8d-c2c3-424d-bfac-85c45c933c3f", "name": "cheerful-coral-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 53170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:19:31.069881+00:00", "ended_at": "2026-08-26T02:19:31.181026+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "931905bc-36bd-4daa-b313-b5122f8da6ab", "name": "downy-fleeting-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 51506, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:17:59.251170+00:00", "ended_at": "2026-08-26T02:17:59.363866+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "61d72bba-8d47-4b21-b0f0-7290e074ffd4", "name": "courtly-buoyant-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 49840, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:16:35.224788+00:00", "ended_at": "2026-08-26T02:16:35.345945+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9f0c38ab-7d74-4f45-9709-925c07f57086", "name": "calm-weathered-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 48190, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:15:09.339161+00:00", "ended_at": "2026-08-26T02:15:09.473040+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "723ab6b9-4146-451e-b7c1-271028b2546a", "name": "marine-genial-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 46520, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:13:47.761612+00:00", "ended_at": "2026-08-26T02:13:48.140909+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ab05c225-3da9-421e-8a47-bb09081dff20", "name": "shifting-vaulted-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 44862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:12:26.830621+00:00", "ended_at": "2026-08-26T02:12:26.965939+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0e6fed00-b7cd-44c2-9f73-dd049ad1b891", "name": "early-bashful-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 43162, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:11:09.579049+00:00", "ended_at": "2026-08-26T02:11:09.889769+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3ac2f1d1-ca0b-4973-8a18-3babda928bae", "name": "sunlit-downy-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 41454, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:09:52.688277+00:00", "ended_at": "2026-08-26T02:09:52.818372+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cd9b9faf-af79-494b-8a6e-7270513815f4", "name": "prairie-vigilant-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 39780, "username": "test3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:08:29.835652+00:00", "ended_at": "2026-08-26T02:08:30.247777+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5d471f8a-2b1e-4405-963a-d70444187b2a", "name": "plush-kindly-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "193.32.162.84", "src_port": 38086, "username": "test2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-26T02:07:00.596326+00:00", "ended_at": "2026-08-26T02:07:00.772857+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c72c6066-3a0b-45ff-9582-797fa577a4e0", "name": "creaky-candid-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.190.51.254", "src_port": 54534, "username": "mysql", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 80, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T23:54:45.005639+00:00", "ended_at": "2026-08-25T23:54:45.156423+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3266 }, { "id": "364747fc-ec9b-48cb-8c58-52d229e4e448", "name": "grumpy-thrifty-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42906, "username": "sugi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:41:23.496432+00:00", "ended_at": "2026-08-25T23:41:25.369112+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "f5af030e-15d7-42d5-9389-6146af73813a", "name": "proud-distant-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34490, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:40:26.920073+00:00", "ended_at": "2026-08-25T23:40:28.651858+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "e126b4fe-f5cd-4ede-82a6-73f5a3a319c2", "name": "brave-bold-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 37858, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:40:02.287124+00:00", "ended_at": "2026-08-25T23:40:03.755392+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "bca090cf-b18c-4a76-8f96-1f5e768532da", "name": "genial-steady-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53414, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:39:38.098050+00:00", "ended_at": "2026-08-25T23:39:39.352084+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b3ea0fd4-4acf-455d-b3d1-533fbf03d606", "name": "muted-lively-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46540, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:39:14.935247+00:00", "ended_at": "2026-08-25T23:39:16.752061+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f458f580-865f-4b38-bcc1-2891895ac45c", "name": "thorny-shaded-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49338, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:39:03.913284+00:00", "ended_at": "2026-08-25T23:39:05.813661+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "6191cd38-89b3-4af0-8cb1-9479d1228ed4", "name": "patient-burly-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39194, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:38:50.958198+00:00", "ended_at": "2026-08-25T23:38:53.307826+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "91929bb2-02b5-443d-bc6f-7cf1c45f4495", "name": "tidal-shifting-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 51066, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:38:01.938454+00:00", "ended_at": "2026-08-25T23:38:03.174863+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "37758d2b-07d7-4598-b4e1-70bb522224a7", "name": "jolly-rugged-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 44614, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:37:40.196506+00:00", "ended_at": "2026-08-25T23:37:41.936785+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0f9fbcdc-0ae6-4729-9b74-181724cdae19", "name": "genial-languid-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59526, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:37:17.190397+00:00", "ended_at": "2026-08-25T23:37:19.172251+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "682a1cba-8a04-4562-9b25-e5572c2692aa", "name": "earnest-blazing-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49742, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:36:55.851389+00:00", "ended_at": "2026-08-25T23:36:58.097709+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "eaf16cee-0e20-4788-9f8f-76d384ac5ade", "name": "subtle-wiry-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55222, "username": "test2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:36:41.548782+00:00", "ended_at": "2026-08-25T23:36:43.015441+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "e1293800-9f4a-49c4-8f5f-485ddeaaba22", "name": "solar-prairie-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38702, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:36:32.468076+00:00", "ended_at": "2026-08-25T23:36:34.552030+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "797faa35-72e8-478e-9dd5-c18d9fde1a20", "name": "vaulted-ginger-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50102, "username": "yarn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:36:19.469020+00:00", "ended_at": "2026-08-25T23:36:21.105119+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "e07ec24a-5dba-4755-9553-4a99af21f1ee", "name": "buoyant-flinty-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43310, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:35:20.410221+00:00", "ended_at": "2026-08-25T23:35:22.356091+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "e3f8f8b2-3a52-49dd-a8a0-ab06e7a797eb", "name": "rugged-somber-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 40806, "username": "awsgui", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:35:05.747250+00:00", "ended_at": "2026-08-25T23:35:08.023095+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1fe7988a-0012-404d-91bc-5f18413a9c3f", "name": "rambling-faded-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45938, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:34:57.364746+00:00", "ended_at": "2026-08-25T23:34:59.514185+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0fcad513-209d-421e-a0c7-81b876440d02", "name": "jovial-snowy-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49234, "username": "uftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:34:07.675480+00:00", "ended_at": "2026-08-25T23:34:08.892493+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f729eb7b-5160-4fcb-bf0a-12051a0e622b", "name": "steady-boreal-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47422, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:33:45.142559+00:00", "ended_at": "2026-08-25T23:33:46.929195+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a1da6eb3-eae9-489a-9c19-2490bac80337", "name": "rugged-granite-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 51674, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:33:23.706174+00:00", "ended_at": "2026-08-25T23:33:25.040941+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0d8c4104-b325-4c73-b3d6-9b86696da4c3", "name": "deft-jagged-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33382, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:32:58.643437+00:00", "ended_at": "2026-08-25T23:33:00.484658+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "32e71fbb-6332-46e2-bac0-3259968a4a9f", "name": "crystal-pristine-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59746, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:32:35.064535+00:00", "ended_at": "2026-08-25T23:32:36.676025+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "72eb8e20-fac8-4875-a83b-b5a53ac454c4", "name": "drifting-feathered-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35056, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:32:11.689401+00:00", "ended_at": "2026-08-25T23:32:13.414041+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b1058540-7f77-4df5-8c56-24dd79b5b619", "name": "humble-sooty-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 44218, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:31:47.164014+00:00", "ended_at": "2026-08-25T23:31:48.739430+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f6e4a9eb-2c29-4582-9e68-027bdcd99917", "name": "autumn-curious-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36136, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:31:25.572135+00:00", "ended_at": "2026-08-25T23:31:27.355846+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9aff9bc9-bfe6-4199-849d-bc9d35288304", "name": "pewter-nimble-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46898, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:31:00.395067+00:00", "ended_at": "2026-08-25T23:31:02.678617+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "1038bb2e-415c-492d-8e2c-43afaef19092", "name": "hazy-opal-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54648, "username": "rabbitmq", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:30:48.612098+00:00", "ended_at": "2026-08-25T23:30:50.914611+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b40fb284-329c-48fa-b6dd-d48fc09e3161", "name": "cobalt-golden-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34844, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:30:38.790313+00:00", "ended_at": "2026-08-25T23:30:41.014329+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "37a10140-f210-4995-9a4d-35b92e761b9f", "name": "nautical-tidal-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50520, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:29:50.033387+00:00", "ended_at": "2026-08-25T23:29:51.221063+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6f121324-7329-4516-86ba-d41991b0b195", "name": "ancient-weathered-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58466, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:29:28.425703+00:00", "ended_at": "2026-08-25T23:29:30.511673+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a9f8d7a1-9ab3-4273-84b9-6a35bfb41aed", "name": "early-dusky-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47570, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:29:04.595096+00:00", "ended_at": "2026-08-25T23:29:06.342817+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "75e47122-257b-44a3-aebf-02b857736180", "name": "umber-cunning-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43400, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:28:40.479266+00:00", "ended_at": "2026-08-25T23:28:42.616111+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6496b886-e5a3-48c1-9a3b-687984539247", "name": "wooded-primal-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41278, "username": "flask", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:28:17.544368+00:00", "ended_at": "2026-08-25T23:28:18.600530+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8ac7037e-28ab-4099-85d8-9ddc2d4f14e3", "name": "tender-austere-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53238, "username": "esadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:28:01.778746+00:00", "ended_at": "2026-08-25T23:28:03.835542+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "4b325213-5fa0-4e20-a760-50faafc89428", "name": "sooty-gentle-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36200, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:27:53.962773+00:00", "ended_at": "2026-08-25T23:27:56.163661+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8640333f-129f-4dad-8ec7-df7542b96070", "name": "bashful-mindful-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46426, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:27:06.559150+00:00", "ended_at": "2026-08-25T23:27:08.743227+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "432286b9-a85b-4355-9b35-b0bdb0dba822", "name": "mossy-daring-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55786, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:26:42.728379+00:00", "ended_at": "2026-08-25T23:26:44.754720+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "812171e8-50f6-4dcf-ae81-d6bdfb3d52e3", "name": "austere-upland-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45926, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:26:19.355094+00:00", "ended_at": "2026-08-25T23:26:21.048818+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8c7ac0bd-f003-43d7-8160-b00468e4b71a", "name": "misty-ginger-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42428, "username": "svnuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:25:53.112653+00:00", "ended_at": "2026-08-25T23:25:54.703836+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "ecce8467-130d-4a39-a923-b31c8f0b7e26", "name": "russet-hushed-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33370, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:25:31.816023+00:00", "ended_at": "2026-08-25T23:25:34.104861+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "4f944582-7cc5-4be4-ad32-a5889f8fccd4", "name": "prairie-cunning-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34772, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:25:06.431636+00:00", "ended_at": "2026-08-25T23:25:07.933874+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "ddee176d-2aef-4008-8e8a-1691adc37684", "name": "smooth-placid-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:24:44.407457+00:00", "ended_at": "2026-08-25T23:24:46.548675+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "24ef35dd-c694-4269-82ee-c28c7f91a0df", "name": "vivid-honest-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48826, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:24:17.294240+00:00", "ended_at": "2026-08-25T23:24:19.651686+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "fc4f9cfd-1d93-481a-bf0a-82854a2804bf", "name": "noble-feral-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:23:55.064744+00:00", "ended_at": "2026-08-25T23:23:56.673712+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8ec1c16b-c93a-4a2b-97e2-e80a16ef1241", "name": "bashful-nimble-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38462, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:23:32.885365+00:00", "ended_at": "2026-08-25T23:23:34.877457+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c19fdfd2-fb55-40ad-8d7e-a1ebe345b7f4", "name": "hushed-tender-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 37826, "username": "oceanbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:23:20.708739+00:00", "ended_at": "2026-08-25T23:23:22.916448+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "d8a198fe-15cf-4bc4-8bc9-84faafb77620", "name": "electric-blazing-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50606, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:23:09.227149+00:00", "ended_at": "2026-08-25T23:23:10.322783+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0a533b38-c184-45f3-9eda-5646483cd2e5", "name": "misty-blazing-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49090, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:22:21.704965+00:00", "ended_at": "2026-08-25T23:22:23.824744+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f35a583a-2b41-4b40-a0a3-546a7d76428a", "name": "loyal-wooded-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49376, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:21:58.382786+00:00", "ended_at": "2026-08-25T23:21:59.519539+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0e04c071-e7d2-4102-bb0a-a528298a4d92", "name": "feathered-nautical-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50300, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:21:33.177360+00:00", "ended_at": "2026-08-25T23:21:35.404546+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "5551b5e7-cdb2-4099-9fca-6fe49e73f572", "name": "electric-watchful-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33652, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:21:13.939623+00:00", "ended_at": "2026-08-25T23:21:15.393661+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b4bbfafc-55cd-413f-8a3e-851297ea4721", "name": "jaunty-misty-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36594, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:20:46.685651+00:00", "ended_at": "2026-08-25T23:20:48.938053+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "3cb69daa-489e-4e55-8c25-554a1246fe26", "name": "upland-leafy-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50446, "username": "demo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:20:35.185236+00:00", "ended_at": "2026-08-25T23:20:37.133716+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "e006121a-d1ea-4413-b1e2-c47d98f66247", "name": "fleeting-sturdy-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35192, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:20:22.118201+00:00", "ended_at": "2026-08-25T23:20:23.696913+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "5fa150a6-2133-497c-b0e9-e302673b8100", "name": "pleasant-rustic-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56268, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:20:09.020679+00:00", "ended_at": "2026-08-25T23:20:10.150793+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "c9d5bd06-b08a-41f7-ba81-b46b09ef0050", "name": "quiet-honest-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47450, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:19:12.204670+00:00", "ended_at": "2026-08-25T23:19:13.293563+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c625840a-c589-4061-95e9-99e6be377484", "name": "grumpy-dusky-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47582, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:18:50.553245+00:00", "ended_at": "2026-08-25T23:18:52.316493+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "03642040-b55d-4e81-8fa3-269d8ee185fe", "name": "sunlit-gilded-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36982, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:18:25.796570+00:00", "ended_at": "2026-08-25T23:18:26.862842+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "60425efc-fb15-4c94-9204-7e50043659d7", "name": "barren-jagged-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48580, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:18:02.378774+00:00", "ended_at": "2026-08-25T23:18:03.537479+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "4fe84a25-3e56-42cf-84c1-d9ff2e216288", "name": "sleepy-hazel-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48628, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:17:39.547895+00:00", "ended_at": "2026-08-25T23:17:41.083541+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "4f74e156-5593-49e6-8308-0c5615ca722a", "name": "gnarled-hazel-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 60322, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:17:16.658686+00:00", "ended_at": "2026-08-25T23:17:18.106874+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "116eb925-99a4-4036-8397-2f140a038aed", "name": "rugged-windswept-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:16:53.462846+00:00", "ended_at": "2026-08-25T23:16:55.474269+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9313111f-1ea5-4a5d-8f7d-46d752780560", "name": "plush-watchful-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56050, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:16:28.847521+00:00", "ended_at": "2026-08-25T23:16:30.451506+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "476c3bb6-f301-443c-bec0-9d00f04a3f44", "name": "prairie-meadow-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52318, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:16:04.958248+00:00", "ended_at": "2026-08-25T23:16:06.918698+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "2558f8c1-5fb4-4f70-96eb-267902a77eef", "name": "misty-fabled-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39928, "username": "vagrant", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:15:52.633791+00:00", "ended_at": "2026-08-25T23:15:54.458808+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "3d1a1dcb-d0f6-4a3a-9709-da5b8549dce5", "name": "nameless-grumpy-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45128, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:15:40.162966+00:00", "ended_at": "2026-08-25T23:15:41.951233+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "e1409f46-b470-4d7d-be24-370c7fb9b399", "name": "russet-gnarled-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45764, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:14:55.184474+00:00", "ended_at": "2026-08-25T23:14:56.794622+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "bd540ce0-1371-4101-b40c-2ac9f5ea7846", "name": "wistful-hearty-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52772, "username": "elsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:14:31.170546+00:00", "ended_at": "2026-08-25T23:14:32.672013+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "bf722d80-439b-43de-87c6-8ee235f42743", "name": "arctic-bitter-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48326, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:14:06.726570+00:00", "ended_at": "2026-08-25T23:14:08.444233+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9e94cb58-9cae-4fbc-a656-97406ac3851d", "name": "marine-noble-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50148, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:13:42.090917+00:00", "ended_at": "2026-08-25T23:13:44.094285+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "7dfdf601-f858-412e-af0e-3dbfe3902f7d", "name": "earnest-prickly-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59132, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:13:19.618503+00:00", "ended_at": "2026-08-25T23:13:20.984386+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8117e1f0-ceaf-4633-bb0c-eaa85545e128", "name": "dappled-prairie-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55438, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:12:58.388625+00:00", "ended_at": "2026-08-25T23:13:00.018908+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6f85ae6c-2c47-4f3b-956e-69c00d575e7c", "name": "eager-blazing-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52238, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:12:31.535942+00:00", "ended_at": "2026-08-25T23:12:33.169566+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "ab03db24-11bb-4a82-9013-6aeb02fc90ea", "name": "murky-regal-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48516, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:12:19.301366+00:00", "ended_at": "2026-08-25T23:12:20.591327+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "8a11f65b-b2be-4174-8846-8f4bc8ef4ca7", "name": "jaunty-idle-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43494, "username": "docker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:12:08.727841+00:00", "ended_at": "2026-08-25T23:12:09.936421+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "95f1a033-11e6-4361-aa90-849f7bf83817", "name": "vaulted-noble-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38568, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:11:20.282707+00:00", "ended_at": "2026-08-25T23:11:21.445527+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "50dca2de-61af-484c-b41b-6b17bf9eeeeb", "name": "placid-icy-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 60638, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:10:57.921351+00:00", "ended_at": "2026-08-25T23:10:59.046022+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8ee7a36b-552f-4cf0-95bf-f2cab01cfbad", "name": "shaded-idle-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59500, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:10:33.249532+00:00", "ended_at": "2026-08-25T23:10:34.925466+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "bbd2d962-94d9-4140-8b95-640c89eebd0a", "name": "regal-gentle-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 51244, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:10:10.781636+00:00", "ended_at": "2026-08-25T23:10:12.125591+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "d55fc65e-d62c-43dd-b97c-93a0da6428a7", "name": "grumpy-sterling-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36590, "username": "mongodb", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:09:58.986648+00:00", "ended_at": "2026-08-25T23:10:00.905755+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b86e38a3-4416-4f7e-94b0-3c21d0ae234f", "name": "glacial-subtle-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46836, "username": "mongodb", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:09:47.294795+00:00", "ended_at": "2026-08-25T23:09:49.077468+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "33272201-111b-459f-866c-e2b86a6f41ac", "name": "airy-placid-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50844, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:09:00.600782+00:00", "ended_at": "2026-08-25T23:09:02.227308+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "91350c07-831c-4aa5-92a0-39aef5093b10", "name": "cosmic-snowy-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 40336, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:08:36.359447+00:00", "ended_at": "2026-08-25T23:08:37.602469+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "5b74d77a-326c-4cea-ae5b-7df41f4ed8ed", "name": "downy-balmy-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33114, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:08:12.573136+00:00", "ended_at": "2026-08-25T23:08:14.177004+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "ff925ba7-4d21-4d57-9d7d-546761d6792f", "name": "candid-rustic-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54676, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:07:51.082994+00:00", "ended_at": "2026-08-25T23:07:53.270328+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "1eb80850-6aaa-46c8-a7df-0d6e95e6ec57", "name": "honest-patient-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46648, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:07:35.048650+00:00", "ended_at": "2026-08-25T23:07:36.914958+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "ae961457-9065-4d1f-82e5-b4a51c976552", "name": "leafy-dewy-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59462, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:07:25.505641+00:00", "ended_at": "2026-08-25T23:07:26.904018+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "59ac4c13-c6e2-4d5e-924e-b1e4f58c0239", "name": "salty-distant-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55450, "username": "ubnt", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:07:11.891716+00:00", "ended_at": "2026-08-25T23:07:13.958258+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b5810a33-7838-422a-b72c-bcd902fda84e", "name": "quiet-sooty-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48976, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:06:16.010839+00:00", "ended_at": "2026-08-25T23:06:17.557652+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "81986983-ad1c-4011-adf6-68b8b682401b", "name": "keen-peaty-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42622, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:06:01.765566+00:00", "ended_at": "2026-08-25T23:06:02.914723+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b331a737-92e9-4424-b43b-7219a9b77516", "name": "glassy-fringed-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53212, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:05:53.733689+00:00", "ended_at": "2026-08-25T23:05:55.971909+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "daf8791d-4761-4da7-87c4-cbb35db45f18", "name": "bold-languid-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58202, "username": "flink", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:05:05.493691+00:00", "ended_at": "2026-08-25T23:05:07.088225+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "3a08ac23-a703-4065-86d0-1e407ee6fc2d", "name": "nameless-gleaming-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53356, "username": "uftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:04:40.429336+00:00", "ended_at": "2026-08-25T23:04:42.147521+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "cea076b0-d9d1-401d-a8d3-dfa9034c3d70", "name": "breezy-hazel-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58116, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:04:15.251722+00:00", "ended_at": "2026-08-25T23:04:17.309450+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "49fd3e05-61bf-4bc7-af5f-6a96a2955e98", "name": "burly-peaty-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55392, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:03:53.236535+00:00", "ended_at": "2026-08-25T23:03:54.489748+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "e5f03f98-c251-42f5-a6c5-59d487674eef", "name": "zealous-stoic-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48020, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:03:31.851803+00:00", "ended_at": "2026-08-25T23:03:33.894085+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "06e2cd89-6cf9-4fb5-9e39-db75eb29b842", "name": "sullen-crimson-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39346, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:03:07.907067+00:00", "ended_at": "2026-08-25T23:03:09.384906+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "76d14686-e95c-4f9b-9bb2-3931019ff9d3", "name": "fickle-gentle-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:02:42.821463+00:00", "ended_at": "2026-08-25T23:02:44.628803+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "4f297c43-5549-4b8b-91b0-0e20a94077d3", "name": "courtly-silent-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "66.116.242.235", "src_port": 53858, "username": "ftpsecure", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 645, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T23:02:36.705855+00:00", "ended_at": "2026-08-25T23:02:36.911752+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3443 }, { "id": "a3bc1398-f368-4b5d-896b-fcf73a8da5aa", "name": "crimson-airy-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48234, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:02:19.271102+00:00", "ended_at": "2026-08-25T23:02:20.361143+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0293fb81-e291-4a5e-89d1-d58bea830676", "name": "golden-flinty-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50020, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:01:54.453092+00:00", "ended_at": "2026-08-25T23:01:56.122899+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "660ae658-0c80-4915-a036-00f9fde51ccb", "name": "forlorn-patient-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53912, "username": "tools", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:01:33.629398+00:00", "ended_at": "2026-08-25T23:01:35.239935+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6ce679a9-dfa8-4ba8-8d0f-203a1922ace4", "name": "mindful-oaken-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47310, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:01:08.692687+00:00", "ended_at": "2026-08-25T23:01:10.281373+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "fddc5223-0013-48fe-958e-663900614d54", "name": "solemn-rambling-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57788, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:00:45.587392+00:00", "ended_at": "2026-08-25T23:00:47.145456+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "581331c5-8699-48be-8131-823d10e42ed9", "name": "feathered-hushed-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57768, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:00:20.677297+00:00", "ended_at": "2026-08-25T23:00:22.602738+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "24745256-d9ec-42c3-8b42-37ffa1fd2906", "name": "diligent-brisk-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49126, "username": "default", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T23:00:07.143151+00:00", "ended_at": "2026-08-25T23:00:08.697206+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "da260d66-0411-4cce-9086-131110068031", "name": "seaward-tender-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48356, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:59:58.416453+00:00", "ended_at": "2026-08-25T22:59:59.995959+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f27b182d-caf9-4bef-8682-de9a16dbd7ae", "name": "steady-brazen-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55560, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:59:12.156932+00:00", "ended_at": "2026-08-25T22:59:14.500413+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c9f2a910-903e-4c13-b4b5-9cf03e1261a6", "name": "thorny-plush-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56498, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:58:47.893711+00:00", "ended_at": "2026-08-25T22:58:49.435843+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "050fb188-567a-4f79-b55e-7346a7f619a4", "name": "kindly-northern-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52976, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:58:24.774287+00:00", "ended_at": "2026-08-25T22:58:27.057137+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6f5eb11a-ff73-4e26-ba7e-57d8ca541a74", "name": "fleeting-prairie-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34330, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:58:01.764803+00:00", "ended_at": "2026-08-25T22:58:04.179175+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "745d9813-8f01-4e53-8de3-1bcdeb060a99", "name": "quiet-rugged-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42082, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:57:38.172715+00:00", "ended_at": "2026-08-25T22:57:39.372036+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "87772c80-63c1-4ceb-b841-a7cb1e15dbf6", "name": "gleaming-dewy-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35954, "username": "debianuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:57:23.139154+00:00", "ended_at": "2026-08-25T22:57:24.195840+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "94ca28bd-a222-44a6-88eb-29197253cff0", "name": "golden-regal-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39090, "username": "ranger", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:57:12.625781+00:00", "ended_at": "2026-08-25T22:57:14.474022+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "4ad2821c-d2c1-4f69-8120-c7c5a7957200", "name": "twilight-jovial-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57450, "username": "bot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:56:59.272450+00:00", "ended_at": "2026-08-25T22:57:00.683764+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "638bc828-59ec-4a84-baf4-f2f116506e98", "name": "ashen-kindly-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36606, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:56:03.744382+00:00", "ended_at": "2026-08-25T22:56:06.073057+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "015ab64a-1de0-4744-bb3f-e4b620de7a06", "name": "crisp-prickly-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55100, "username": "kubernetes", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:55:49.576628+00:00", "ended_at": "2026-08-25T22:55:51.875941+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "bbae8cf0-107c-4bab-aeca-a2673986fd4a", "name": "silent-knotted-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54268, "username": "observer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:55:39.274644+00:00", "ended_at": "2026-08-25T22:55:40.758050+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "21135fcd-5816-4bb2-b89b-5bc43836d929", "name": "tawny-hushed-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50474, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:54:53.468678+00:00", "ended_at": "2026-08-25T22:54:54.968000+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "184dae14-0953-48f9-900e-1ad58f770beb", "name": "muted-candid-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 60656, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:54:29.233103+00:00", "ended_at": "2026-08-25T22:54:30.727557+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "dc61c859-19b1-4194-94fb-e09df5e5fa40", "name": "cheerful-wooded-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58414, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:54:08.770461+00:00", "ended_at": "2026-08-25T22:54:09.945409+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "5284bc49-d3fd-4077-bdea-f1fae6c41d67", "name": "jolly-velvet-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34102, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:53:50.001759+00:00", "ended_at": "2026-08-25T22:53:51.507051+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "d6da8855-69fe-4798-b318-d1430468e05b", "name": "jagged-lanky-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46038, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:53:42.452331+00:00", "ended_at": "2026-08-25T22:53:44.009532+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "94264fd1-e0be-4e3d-8337-1a977d74e9bc", "name": "icy-gleaming-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36980, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:52:51.908354+00:00", "ended_at": "2026-08-25T22:52:54.323611+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6736e623-32fe-49dd-b69a-ef9841b25099", "name": "glassy-nautical-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 51364, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:52:30.158660+00:00", "ended_at": "2026-08-25T22:52:32.010479+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "28b38217-6c45-4424-ad65-5c303c3fbfd8", "name": "quartz-icy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59142, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:52:06.762481+00:00", "ended_at": "2026-08-25T22:52:08.096069+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a622daf7-6fa5-4afa-965d-c55ec733338c", "name": "ancient-mottled-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47122, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:51:44.560529+00:00", "ended_at": "2026-08-25T22:51:46.692186+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a3ff6fac-8ecd-4a40-a92a-43f64124f888", "name": "slender-whispering-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41676, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:51:25.479419+00:00", "ended_at": "2026-08-25T22:51:27.559740+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b08bb404-10e6-4c06-b31c-a3687badda8c", "name": "western-jovial-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36548, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:51:21.019656+00:00", "ended_at": "2026-08-25T22:51:23.123064+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "e5551569-a392-47cc-b432-c2fbb66d5235", "name": "courtly-fabled-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59918, "username": "weblogic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:51:05.077246+00:00", "ended_at": "2026-08-25T22:51:06.617358+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "e95df60c-0e8a-45df-baa3-4708346b5f5e", "name": "lanky-placid-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35044, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:50:11.633545+00:00", "ended_at": "2026-08-25T22:50:13.779053+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "7aa12222-71b2-4ea8-bb06-1a61ee0c87c3", "name": "barren-stormy-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33864, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:49:56.710580+00:00", "ended_at": "2026-08-25T22:49:58.950299+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b0ad22ce-a782-4f37-ac82-d13805892a97", "name": "patient-regal-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55876, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:49:45.675115+00:00", "ended_at": "2026-08-25T22:49:46.916405+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "1df02353-cfc6-4504-bf54-8504d6cc8550", "name": "smooth-early-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36494, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:49:08.124714+00:00", "ended_at": "2026-08-25T22:49:10.246962+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "64f3a2ef-f2f7-4b86-bbf6-9bca98a53f96", "name": "rapid-mottled-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53938, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:48:57.319835+00:00", "ended_at": "2026-08-25T22:48:59.458453+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "d7b7ca62-50a7-4f8b-aef3-7c628e90648d", "name": "pristine-peaty-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46498, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:48:11.239717+00:00", "ended_at": "2026-08-25T22:48:13.212635+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "e8d13cbe-6512-4bb3-b72a-97e990316a1d", "name": "watchful-wandering-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59852, "username": "flask", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:47:46.240855+00:00", "ended_at": "2026-08-25T22:47:48.077097+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "19c3c6b7-7761-4683-9434-0edb5018f8e8", "name": "gloomy-slender-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43594, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:47:34.508822+00:00", "ended_at": "2026-08-25T22:47:36.103306+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "e04cd55c-2956-447f-a348-27a16874c4f0", "name": "wry-woven-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50768, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:47:24.409267+00:00", "ended_at": "2026-08-25T22:47:25.490334+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "ad0ce054-1310-4b19-a3b6-358d89304857", "name": "kindly-hidden-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36654, "username": "gpuadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:47:07.754459+00:00", "ended_at": "2026-08-25T22:47:10.113282+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "ba70839e-5ac5-4344-a4fc-7bd44f9ad181", "name": "hollow-russet-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46266, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:46:23.460590+00:00", "ended_at": "2026-08-25T22:46:25.260609+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "6707ae1d-361e-439b-9f8f-a89bf4248eee", "name": "sincere-ashen-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42312, "username": "flask", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:46:12.328860+00:00", "ended_at": "2026-08-25T22:46:13.561450+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9d39c5b6-7b8c-4607-9b18-3abc2c0d6968", "name": "spirited-crimson-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 32822, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:45:25.059903+00:00", "ended_at": "2026-08-25T22:45:27.442342+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "1c475719-b626-4605-829f-0a8f977d4504", "name": "windswept-gritty-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56304, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:45:01.310036+00:00", "ended_at": "2026-08-25T22:45:03.690649+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6ea55022-a3dc-4574-893c-107371b398da", "name": "brave-tender-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 49618, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:44:48.960877+00:00", "ended_at": "2026-08-25T22:44:51.110774+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "6ff0cbb2-5374-4832-886d-6cc9f4b20593", "name": "sleepy-hollow-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36574, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:44:39.947086+00:00", "ended_at": "2026-08-25T22:44:42.018665+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "20f331ff-e0f2-4c26-85c7-eac8ce0cfe26", "name": "amber-jagged-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58348, "username": "ts", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:44:02.833517+00:00", "ended_at": "2026-08-25T22:44:04.195386+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1d4505f1-ae7b-4653-8fb3-e8e7c7c429a7", "name": "velvet-lawful-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39992, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:43:52.336809+00:00", "ended_at": "2026-08-25T22:43:54.557723+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c10740b8-41e9-4725-afcf-1f6ce9fe46ce", "name": "verdant-windswept-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 60030, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:43:06.111706+00:00", "ended_at": "2026-08-25T22:43:07.664818+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b6959116-24e6-4bc7-88dd-27ebdd16c659", "name": "plush-vaulted-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45736, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:42:42.832094+00:00", "ended_at": "2026-08-25T22:42:44.854466+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c54430fb-6908-41af-b648-686919855684", "name": "frosty-hollow-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38644, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:42:17.792046+00:00", "ended_at": "2026-08-25T22:42:18.906971+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "386e4798-2d59-46a5-ba26-80e8772fa703", "name": "thawing-boreal-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35476, "username": "docker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:42:03.482269+00:00", "ended_at": "2026-08-25T22:42:05.783153+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1eed7fda-fd9f-49b7-82f7-b34b817dc41b", "name": "forlorn-solemn-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46938, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:41:54.265687+00:00", "ended_at": "2026-08-25T22:41:55.481016+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "eefdff33-bdfc-4b02-947d-3216495495c1", "name": "drifting-frank-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50176, "username": "observer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 458, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:41:39.057150+00:00", "ended_at": "2026-08-25T22:41:41.424898+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "6f9d3f09-1103-4abf-a430-c454bc4321f5", "name": "cheerful-lawful-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50052, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:40:54.412455+00:00", "ended_at": "2026-08-25T22:40:56.284368+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "53c11ccf-82e1-4a42-aa1e-3001fa457df9", "name": "pleasant-ivory-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54528, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:40:45.459129+00:00", "ended_at": "2026-08-25T22:40:46.786055+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "3ebd00cf-3fb9-48da-b057-d9d7a0b21136", "name": "freckled-dusty-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38688, "username": "plex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:39:55.986695+00:00", "ended_at": "2026-08-25T22:39:57.179955+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "d16578d9-182b-4b0f-936b-9c2d0de300a4", "name": "marine-icy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57722, "username": "bigdata", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:39:42.839230+00:00", "ended_at": "2026-08-25T22:39:45.217167+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "4bad3a25-0cbb-497c-9636-5727300f122f", "name": "scarlet-smooth-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 40264, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:39:31.332989+00:00", "ended_at": "2026-08-25T22:39:33.244845+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c9f686bb-1105-4402-8774-08f00f2d7e60", "name": "patient-nameless-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 37658, "username": "data", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:39:20.085077+00:00", "ended_at": "2026-08-25T22:39:21.375495+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "04a79344-6711-472f-98f2-e654011aa2fe", "name": "tidal-earnest-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33286, "username": "uftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:38:58.966705+00:00", "ended_at": "2026-08-25T22:39:01.167272+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "207272d3-5843-4ba3-a8cc-7e201363f851", "name": "sooty-peaty-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39816, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:37:56.573361+00:00", "ended_at": "2026-08-25T22:37:58.098106+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "56157b66-dff2-4f5b-83f5-a8a86fbdcc89", "name": "coral-merry-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38270, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:37:35.120028+00:00", "ended_at": "2026-08-25T22:37:36.991576+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f8b99659-8fdd-4b9a-a44f-2afc68c7ad8d", "name": "thrifty-canny-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 59960, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:37:13.638948+00:00", "ended_at": "2026-08-25T22:37:15.788940+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "7154ed7d-f070-43c4-b020-0fb4e4a3ee2a", "name": "sincere-drifting-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35402, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:36:49.343509+00:00", "ended_at": "2026-08-25T22:36:51.683664+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "fb69bc53-6db7-46dd-90ee-fbc3c2b329af", "name": "thawing-mottled-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57928, "username": "rancher", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:36:25.412224+00:00", "ended_at": "2026-08-25T22:36:26.742124+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b284992f-208f-43f8-b9d9-206bfb009285", "name": "coral-hardy-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57170, "username": "rancher", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:36:11.274199+00:00", "ended_at": "2026-08-25T22:36:13.487151+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "22406936-4871-4056-812d-b79b1c9f1259", "name": "whispering-stormy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56830, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:36:00.038135+00:00", "ended_at": "2026-08-25T22:36:01.509739+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "ab71b7d7-b538-4b20-bebf-fbf3f1d4285b", "name": "hidden-fierce-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 40346, "username": "elsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:35:25.849581+00:00", "ended_at": "2026-08-25T22:35:27.561266+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "3272298f-c71e-4b40-9938-acc4f4844c4f", "name": "crystal-ivory-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 60136, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:35:14.361345+00:00", "ended_at": "2026-08-25T22:35:16.704520+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0e566557-972c-4baa-8168-190fb350d358", "name": "electric-icy-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46794, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:35:00.045991+00:00", "ended_at": "2026-08-25T22:35:02.072374+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "924ea7a3-ea29-4ba4-927d-214c9ff8fb50", "name": "dusty-tawny-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55994, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:34:06.482757+00:00", "ended_at": "2026-08-25T22:34:07.671595+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "994886e6-0844-46c9-b956-2c09c31512b3", "name": "opal-wry-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48114, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:33:49.565836+00:00", "ended_at": "2026-08-25T22:33:51.120635+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "62c9b57d-ca0b-426b-a2c7-fc8774266a35", "name": "lively-sunlit-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54966, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:33:39.917713+00:00", "ended_at": "2026-08-25T22:33:41.996621+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9a6de18d-ba3b-4bc9-a257-166d2fa2acf1", "name": "cobalt-dewy-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38816, "username": "ranger", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:33:02.119307+00:00", "ended_at": "2026-08-25T22:33:03.432710+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1be70e1d-98ac-47db-b496-9ea41a056881", "name": "flinty-marine-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 40550, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:32:52.166935+00:00", "ended_at": "2026-08-25T22:32:53.370704+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "d607b5e9-637e-4478-a067-1788a2078d12", "name": "stormy-gnarled-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 37888, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:32:06.837811+00:00", "ended_at": "2026-08-25T22:32:08.468007+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9dff8ee0-5675-48b1-94bb-7b9171aea0eb", "name": "tender-amiable-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41856, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:31:40.613573+00:00", "ended_at": "2026-08-25T22:31:41.715534+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b3515301-062f-4ab7-9561-f6c0311d66e9", "name": "vaulted-restless-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36630, "username": "jumpserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:31:30.956011+00:00", "ended_at": "2026-08-25T22:31:32.396089+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "c19344bf-731f-485f-901d-972f428af6bf", "name": "mindful-coastal-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52282, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:31:15.816954+00:00", "ended_at": "2026-08-25T22:31:17.370424+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6c717c7a-80b7-401b-a093-e64e7bf451d7", "name": "alpine-nimble-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58064, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:30:32.131093+00:00", "ended_at": "2026-08-25T22:30:34.332046+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "9ed95d55-0a03-47b7-a316-eb83687549ca", "name": "pleasant-cobalt-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38140, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:30:18.497025+00:00", "ended_at": "2026-08-25T22:30:19.758234+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "07650efb-1630-4fe1-90b0-49d6eee9e957", "name": "scarlet-regal-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 60886, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:30:08.426826+00:00", "ended_at": "2026-08-25T22:30:10.534833+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "806dbfb8-265c-4f64-a92b-b3a8ee24356a", "name": "painted-brazen-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41846, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:29:30.184758+00:00", "ended_at": "2026-08-25T22:29:32.501900+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "dced8a57-a7a0-473e-a13e-5c1730e0941b", "name": "fleeting-ruddy-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53074, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:29:19.757740+00:00", "ended_at": "2026-08-25T22:29:21.444017+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8e167d20-e2c2-4d3b-a0fc-f0f10e47e373", "name": "polar-coastal-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55104, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:28:33.445154+00:00", "ended_at": "2026-08-25T22:28:34.951863+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "41c51f59-4c2c-45df-9e98-d40fe105fcb6", "name": "daring-stormy-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 50452, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:28:20.884827+00:00", "ended_at": "2026-08-25T22:28:22.426400+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "a5a78cd3-abd9-4c63-aa1c-7753f8a571ae", "name": "hushed-ivory-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 51678, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:28:09.742908+00:00", "ended_at": "2026-08-25T22:28:11.806653+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f97c2541-41a6-4394-b9eb-2d48eaad2105", "name": "plucky-whispering-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42784, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:27:21.894240+00:00", "ended_at": "2026-08-25T22:27:24.229892+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "5c28dff0-5360-42ca-8794-6fa9af44424d", "name": "distant-oaken-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41540, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:26:58.588120+00:00", "ended_at": "2026-08-25T22:27:00.715421+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "10b38927-fe1e-4f6e-b068-a90148a11236", "name": "somber-feathered-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41342, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:26:43.490017+00:00", "ended_at": "2026-08-25T22:26:45.297006+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "a021f4a2-a7c5-4340-89e6-1e952433f813", "name": "emerald-supple-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55476, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:26:34.428169+00:00", "ended_at": "2026-08-25T22:26:35.727058+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "714d1e77-8f74-4da6-b643-e5968420d854", "name": "hazel-fearless-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41030, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:25:47.417706+00:00", "ended_at": "2026-08-25T22:25:49.053257+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "7dce3b21-d3bf-48d2-9b9d-a3e5abc26158", "name": "western-thrifty-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46316, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:25:24.051016+00:00", "ended_at": "2026-08-25T22:25:26.476435+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "b9998c00-d6b1-4b99-bff5-d6f8ff4e9a97", "name": "faded-spirited-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43082, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:25:03.384103+00:00", "ended_at": "2026-08-25T22:25:05.264850+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6e97a013-1b24-4bac-8dd8-ab3897aa8959", "name": "polar-painted-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45684, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:24:37.697084+00:00", "ended_at": "2026-08-25T22:24:39.207885+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "c98b46cf-75d3-42c3-9d1b-d288f050c59f", "name": "fickle-feral-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34512, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:24:12.157296+00:00", "ended_at": "2026-08-25T22:24:13.495953+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a12b0c4b-05f9-41e1-af99-30864cce785a", "name": "indigo-ginger-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45126, "username": "tools", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:23:58.615788+00:00", "ended_at": "2026-08-25T22:24:00.738873+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "398e2fc8-5b19-42b0-a6c0-fd1e020bf20b", "name": "grumpy-wry-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48720, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:23:50.762837+00:00", "ended_at": "2026-08-25T22:23:53.000821+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "2a43eef2-9496-4d59-9f25-cdf6fda962f3", "name": "daring-downy-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 47528, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:23:32.472045+00:00", "ended_at": "2026-08-25T22:23:34.005708+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "75e2ea7f-660f-42fe-b414-98e7e6b715b3", "name": "lawful-coastal-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 38596, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:23:10.108678+00:00", "ended_at": "2026-08-25T22:23:12.297878+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1860e5ec-4b0a-4281-9fc9-b257f98ef837", "name": "vernal-western-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52064, "username": "plexserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:22:49.210462+00:00", "ended_at": "2026-08-25T22:22:50.523018+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "54b037dc-6cfd-4463-bd09-775fe42050fd", "name": "frank-salty-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 36536, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:22:02.908823+00:00", "ended_at": "2026-08-25T22:22:04.372732+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1b024e74-7acf-4960-887f-170b3cc1b22c", "name": "crimson-mindful-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 34150, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:21:53.130947+00:00", "ended_at": "2026-08-25T22:21:55.457181+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "8153f8e4-767d-473b-a2ee-a0b4e5f4afd2", "name": "crimson-dapper-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45828, "username": "svnuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:21:38.419673+00:00", "ended_at": "2026-08-25T22:21:39.805576+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "a3356dad-ba2e-4200-80a9-03e2aba76fcf", "name": "earnest-steady-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42086, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:21:12.296904+00:00", "ended_at": "2026-08-25T22:21:14.245561+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "fca26d3c-6b07-4b52-9558-9abdcf5ff522", "name": "sullen-gleaming-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57412, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:20:16.813188+00:00", "ended_at": "2026-08-25T22:20:18.156940+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "0fd04087-fc97-4f90-971d-480ce8da56ab", "name": "rustic-peaty-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 51012, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:20:04.200226+00:00", "ended_at": "2026-08-25T22:20:06.011798+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "b4fca60b-71e9-4689-ad27-7ae3195b23b2", "name": "gallant-merry-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35572, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:19:53.307124+00:00", "ended_at": "2026-08-25T22:19:55.580718+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "6fc8e561-466c-46a7-b4b4-b8ba9146baa7", "name": "mighty-loyal-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35062, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:19:05.272370+00:00", "ended_at": "2026-08-25T22:19:07.464704+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "5081d3e7-dbb4-49be-839d-883556530523", "name": "alpine-restless-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 44926, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:18:41.134038+00:00", "ended_at": "2026-08-25T22:18:43.210167+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "79bc682a-6f05-4109-9346-d538c25a6b7a", "name": "stoic-windswept-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 53024, "username": "flink", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:18:27.991962+00:00", "ended_at": "2026-08-25T22:18:30.313833+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "6e609137-f5b2-4fca-be36-f40c1437a928", "name": "fabled-gallant-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54274, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:18:20.002270+00:00", "ended_at": "2026-08-25T22:18:22.410717+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "4950acf3-c047-4cc1-bb5b-9be42c239bd7", "name": "kindly-pristine-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42476, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:17:31.072714+00:00", "ended_at": "2026-08-25T22:17:32.799035+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "7432cad2-6572-4758-a873-1696f2a0630d", "name": "boreal-sooty-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 40804, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:17:07.813663+00:00", "ended_at": "2026-08-25T22:17:09.983068+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "20ec1718-f3b1-4a39-9b26-a333dcb109b1", "name": "earnest-sunlit-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39066, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:16:45.204006+00:00", "ended_at": "2026-08-25T22:16:46.237761+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a5e1f44e-f9ed-4eab-b397-8c1b3405d219", "name": "seaward-fickle-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39084, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:16:31.719082+00:00", "ended_at": "2026-08-25T22:16:33.224564+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "c890048d-fe81-4d69-8af3-f6bcafc26966", "name": "flinty-restless-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46922, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 453, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:16:19.146394+00:00", "ended_at": "2026-08-25T22:16:20.610947+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "96082378-a88e-49b2-8d7b-2f5d7dfcfdb9", "name": "fearless-lucid-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46566, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:15:45.032032+00:00", "ended_at": "2026-08-25T22:15:47.325065+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "18f2163f-b021-4a5f-920d-06fa231b1d0a", "name": "dusty-somber-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 45500, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:15:32.386440+00:00", "ended_at": "2026-08-25T22:15:34.702113+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "89e92559-8662-48e5-81cc-7eee8446dd07", "name": "twilight-mellow-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33700, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 452, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:14:55.842114+00:00", "ended_at": "2026-08-25T22:14:57.009020+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "8c61c92f-d795-4d00-ae8f-97d4b601076a", "name": "dewy-proud-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 55348, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:14:46.191994+00:00", "ended_at": "2026-08-25T22:14:48.404023+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a0221c51-04c8-4e49-9257-8cc4a98def6a", "name": "keen-flinty-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58572, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:14:09.368283+00:00", "ended_at": "2026-08-25T22:14:10.607122+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "ee7bf61f-f523-4697-aae2-a6c247d4ac1b", "name": "chilly-brazen-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39732, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:13:58.392291+00:00", "ended_at": "2026-08-25T22:13:59.935320+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "df527205-46ba-458e-a5e3-1265cf968d78", "name": "autumn-merry-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 46496, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:13:18.054435+00:00", "ended_at": "2026-08-25T22:13:19.972463+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "d55378da-5c49-441c-9f79-117026b658ef", "name": "dutiful-forlorn-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 57584, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:13:08.873273+00:00", "ended_at": "2026-08-25T22:13:10.661293+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "70fddfbb-601f-4c7b-8fa4-2bdbbf1a3667", "name": "buoyant-western-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43142, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:12:33.424223+00:00", "ended_at": "2026-08-25T22:12:34.623901+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "1728f8f3-e79e-42ba-915c-0679f5dba144", "name": "gilded-serene-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41770, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:12:21.893310+00:00", "ended_at": "2026-08-25T22:12:23.388567+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "a6002e75-6ca4-4d41-a97d-50e82974c54e", "name": "proud-amiable-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 52150, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:12:09.195752+00:00", "ended_at": "2026-08-25T22:12:11.310892+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "705a32fe-b643-49ed-8428-a8819ee8e40e", "name": "lawful-painted-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48804, "username": "flask", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:11:45.291904+00:00", "ended_at": "2026-08-25T22:11:47.172394+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "0d3d9e7c-7979-494b-874b-fd09878fc8a0", "name": "rustic-nimble-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35070, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:11:22.438065+00:00", "ended_at": "2026-08-25T22:11:23.899663+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "cad32e71-662b-4688-bdde-ef6c146aa02b", "name": "tranquil-drifting-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 54162, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:10:26.690244+00:00", "ended_at": "2026-08-25T22:10:28.636320+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "d2ccf448-cf95-4aaa-af1c-3a2868501cbb", "name": "ruddy-bold-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 43866, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:10:01.588098+00:00", "ended_at": "2026-08-25T22:10:03.595831+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "256a4516-3c2b-428d-a296-3004ea68fb42", "name": "blithe-jaunty-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33734, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:09:48.783147+00:00", "ended_at": "2026-08-25T22:09:50.161919+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "bb17a0cb-984a-47e4-a7a4-3edfff41ef91", "name": "thrifty-downy-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35732, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:09:38.228607+00:00", "ended_at": "2026-08-25T22:09:39.764730+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "f6442426-2687-47df-84b5-af52cea31b32", "name": "muted-kindly-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41280, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:09:24.406014+00:00", "ended_at": "2026-08-25T22:09:25.651221+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "da5f53b2-7791-4e84-bc9c-55d6ad3d7a9e", "name": "blazing-shaded-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 33756, "username": "esroot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:09:00.689255+00:00", "ended_at": "2026-08-25T22:09:01.990658+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "216f0a0b-d6e5-4b92-968d-5464937f9cd5", "name": "craggy-hearty-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35230, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:08:15.283092+00:00", "ended_at": "2026-08-25T22:08:17.241577+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "e7bbb7dc-3457-44d9-b00c-8a17259fad56", "name": "kindly-painted-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 32888, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:08:04.636448+00:00", "ended_at": "2026-08-25T22:08:06.625574+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 617 }, { "id": "60ef47e0-2836-429a-bd8c-c25a12d1ed5f", "name": "lucid-reedy-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48882, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:07:41.516292+00:00", "ended_at": "2026-08-25T22:07:42.932902+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "ca64b978-792c-4766-af86-01435e1706ad", "name": "dutiful-airy-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 39624, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:07:19.225211+00:00", "ended_at": "2026-08-25T22:07:20.195223+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "5844150c-205f-4575-9fec-814903bad768", "name": "fearless-placid-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 58340, "username": "mongo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:06:55.488491+00:00", "ended_at": "2026-08-25T22:06:56.615422+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "2caf2b92-8f59-448c-820c-0da13eeea735", "name": "granite-rambling-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42728, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:06:31.584686+00:00", "ended_at": "2026-08-25T22:06:32.478402+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "2d879878-7a16-4c0e-b35b-db039ec644a2", "name": "genial-feral-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 48290, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 458, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:06:06.630198+00:00", "ended_at": "2026-08-25T22:06:07.709209+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "222becad-df09-4d0d-86f0-3225349ee5ea", "name": "diligent-barren-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 56218, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:05:38.561696+00:00", "ended_at": "2026-08-25T22:05:39.646362+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "cd290d6c-873c-4e6d-8ebc-9200091cf1a1", "name": "honest-nimble-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 41258, "username": "hive", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:05:15.300004+00:00", "ended_at": "2026-08-25T22:05:15.540067+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "8e6549b8-30c5-4e98-b3c5-1dafaa34fff8", "name": "salty-upland-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 35296, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:04:52.203610+00:00", "ended_at": "2026-08-25T22:04:52.454453+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "386a6838-f30c-4c9d-82fe-e65e35dd9b0f", "name": "hearty-breezy-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "104.43.56.65", "src_port": 42924, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 451, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T22:04:28.685097+00:00", "ended_at": "2026-08-25T22:04:28.929096+00:00", "ended_reason": "exec complete", "commands": 10, "transcript_bytes": 1353 }, { "id": "02d24a53-b8a1-475b-9430-57bff8df9935", "name": "dapper-umber-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "107.150.103.210", "src_port": 26246, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T21:16:25.635410+00:00", "ended_at": "2026-08-25T21:16:25.703055+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3446 }, { "id": "e7a6b43a-b63c-43b3-8917-d473018c1a10", "name": "coastal-wooded-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "221.163.5.228", "src_port": 38312, "username": "prova", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 639, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T21:16:09.535535+00:00", "ended_at": "2026-08-25T21:16:09.734162+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3496 }, { "id": "226ca8b8-8952-4e81-9e49-94cbe42a94be", "name": "leafy-curious-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "179.176.210.17", "src_port": 45675, "username": "andrew", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T21:14:31.390603+00:00", "ended_at": "2026-08-25T21:14:31.522244+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3935 }, { "id": "b5b711e3-b29d-4a67-930b-0db5ed26a3d2", "name": "russet-tender-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 36074, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:19:59.469770+00:00", "ended_at": "2026-08-25T20:19:59.562767+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "44fb8cee-4471-49c8-be6d-23b3275695f8", "name": "graceful-hidden-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 33184, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:18:22.580019+00:00", "ended_at": "2026-08-25T20:18:22.679680+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9f207e45-632a-4f27-84d8-f2c595494998", "name": "meadow-courtly-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 58522, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:16:41.586621+00:00", "ended_at": "2026-08-25T20:16:41.705162+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3831a4c5-ed76-4712-b1d6-93ae99939f25", "name": "cunning-regal-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 55592, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:15:01.214999+00:00", "ended_at": "2026-08-25T20:15:01.310337+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "99c40f92-1004-4b9c-a587-5f5726ab9834", "name": "shaded-forlorn-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 52688, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:13:33.789865+00:00", "ended_at": "2026-08-25T20:13:33.890006+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0b0f1e79-8399-45ec-a2e4-200ebb4a9d19", "name": "watchful-graceful-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 49770, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:12:09.820908+00:00", "ended_at": "2026-08-25T20:12:09.917126+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c849ad70-50ee-411c-9fd3-d0d0b18460d8", "name": "lonesome-gritty-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 46870, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:10:47.226810+00:00", "ended_at": "2026-08-25T20:10:47.368635+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c4eb0bf7-322f-4118-9941-92aea8bedd4b", "name": "coral-prickly-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 43950, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:09:26.946134+00:00", "ended_at": "2026-08-25T20:09:27.060260+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bd34f6e4-d94b-47d5-accb-f6619a1343f5", "name": "jovial-velvet-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.191.239.155", "src_port": 40632, "username": "noah", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 71, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:08:25.924409+00:00", "ended_at": "2026-08-25T20:08:25.932797+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3738 }, { "id": "b6240404-4d47-4e1a-8755-b88a04918a25", "name": "thrifty-hazel-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 41046, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:08:03.312257+00:00", "ended_at": "2026-08-25T20:08:03.419427+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3f39d2b5-61b0-46b9-9162-e1cb4fed8b6b", "name": "twilight-inland-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 38160, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:06:42.266051+00:00", "ended_at": "2026-08-25T20:06:42.364708+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2c335481-a1b3-429d-bf9a-2c21692a5999", "name": "graceful-meadow-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.191.239.155", "src_port": 35724, "username": "kevin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:05:53.837677+00:00", "ended_at": "2026-08-25T20:05:54.477751+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2311 }, { "id": "3fc6c288-f62d-46fb-93a5-0d01320fc10c", "name": "gallant-knotted-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 35242, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:05:22.927067+00:00", "ended_at": "2026-08-25T20:05:23.026667+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "396157d5-46ec-4483-b750-f3958048f504", "name": "ivory-pristine-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 60586, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:03:58.659064+00:00", "ended_at": "2026-08-25T20:03:58.777698+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5b4faae1-6143-476e-bcaf-c9c2f8ffb15a", "name": "jovial-electric-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 57700, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:02:31.110667+00:00", "ended_at": "2026-08-25T20:02:31.530605+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4e8de1db-8234-476a-8caa-9db495484119", "name": "cunning-jolly-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 54804, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T20:01:02.117139+00:00", "ended_at": "2026-08-25T20:01:02.219936+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "97698eff-26fd-483a-afc7-fc2c4f06b0dc", "name": "ancient-tranquil-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "185.158.22.150", "src_port": 32670, "username": "mega", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 518, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:00:52.318042+00:00", "ended_at": "2026-08-25T20:00:52.476609+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3539 }, { "id": "5ab389f2-2ab3-4d81-b9ca-0b4d742dd8ff", "name": "lunar-orderly-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.174.238.116", "src_port": 48254, "username": "noah", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:00:06.348189+00:00", "ended_at": "2026-08-25T20:00:06.453476+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3214 }, { "id": "da310bad-a42a-4ef3-bb18-3b7c38259967", "name": "smoky-balmy-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 51878, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:59:38.290710+00:00", "ended_at": "2026-08-25T19:59:38.386793+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d1070992-b8f4-4544-9ef1-f46b02c41c69", "name": "fleeting-bronzed-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 48908, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:58:14.850025+00:00", "ended_at": "2026-08-25T19:58:14.953214+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f95d08cf-58ec-400b-9edc-77ad9b66bf95", "name": "forlorn-burly-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 46026, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:56:52.595018+00:00", "ended_at": "2026-08-25T19:56:52.692461+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fc99e17d-ebc9-4f67-8655-d2c9f5f30b6b", "name": "fabled-wistful-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 43092, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:55:21.893056+00:00", "ended_at": "2026-08-25T19:55:21.988961+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "363f34e1-fc48-42df-a921-01e431b5c77e", "name": "wandering-coastal-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "124.156.173.135", "src_port": 51870, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 673, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T19:55:06.836657+00:00", "ended_at": "2026-08-25T19:55:07.041931+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3981 }, { "id": "f268e563-ffa4-4d94-8f2c-04eeb41b0b1f", "name": "arctic-rugged-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 40180, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:53:52.064395+00:00", "ended_at": "2026-08-25T19:53:52.162349+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8cb965bd-ccac-4fcb-a146-078a680bfd99", "name": "emerald-austere-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.190.51.254", "src_port": 45350, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 100, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T19:52:48.798094+00:00", "ended_at": "2026-08-25T19:52:48.815144+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3356 }, { "id": "5d4208b8-1253-483c-8413-36c9194f2fed", "name": "vivid-velvet-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 37274, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:52:23.497385+00:00", "ended_at": "2026-08-25T19:52:23.602148+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0da5c087-63a8-41d0-b310-5195c5a6e4e3", "name": "stormy-feral-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 34370, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:50:53.260496+00:00", "ended_at": "2026-08-25T19:50:53.359897+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cff50beb-ad80-41c8-9e5f-6b6a47443120", "name": "wry-watchful-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 59706, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:49:18.635370+00:00", "ended_at": "2026-08-25T19:49:18.738173+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3f0af1a1-5c09-4d50-abf3-2517c23df58e", "name": "leafy-chilly-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 56798, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:47:47.672632+00:00", "ended_at": "2026-08-25T19:47:47.765117+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "30f7c581-721a-44f9-b11f-af3419b8c0ce", "name": "thrifty-kindly-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 53862, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:46:22.329494+00:00", "ended_at": "2026-08-25T19:46:22.445193+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7b5c2cd7-31fc-49d4-ab28-236d454bd21a", "name": "regal-idle-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 50936, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:44:56.409873+00:00", "ended_at": "2026-08-25T19:44:56.598777+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3ffd13d1-787e-4c07-bf4f-8000c4c75c35", "name": "chilly-blazing-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 48044, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:43:29.612349+00:00", "ended_at": "2026-08-25T19:43:29.714536+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "224311b1-1b22-46fe-b8d2-0064d3deb6eb", "name": "kindly-foggy-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 45118, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:42:05.728724+00:00", "ended_at": "2026-08-25T19:42:05.830236+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6b6fe276-7cad-474e-804b-ad8e9ccfe191", "name": "early-hushed-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 42214, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:40:34.636246+00:00", "ended_at": "2026-08-25T19:40:34.730735+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "03531a0a-c62a-4fc8-ae99-bb588442e919", "name": "upland-ivory-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 39312, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:39:03.733626+00:00", "ended_at": "2026-08-25T19:39:03.854029+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "56663a2f-2052-4253-98a0-7aea3e01c121", "name": "dappled-spirited-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 36400, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:37:29.305518+00:00", "ended_at": "2026-08-25T19:37:29.501196+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5e0d22c3-7ecc-4ea9-a35d-4116b5f055ed", "name": "patient-wiry-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 33516, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:35:47.779161+00:00", "ended_at": "2026-08-25T19:35:47.882330+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "af71104a-3955-48b5-92c1-d0c9f105094e", "name": "pristine-boreal-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 58862, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:34:06.592473+00:00", "ended_at": "2026-08-25T19:34:06.718382+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3284199c-55e1-4403-b285-edcc8e12abe3", "name": "gloomy-sleepy-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 55950, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:32:33.888760+00:00", "ended_at": "2026-08-25T19:32:33.990268+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a969cad1-b005-430b-8775-a491f8fa0686", "name": "plush-autumn-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 53074, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:30:58.402375+00:00", "ended_at": "2026-08-25T19:30:58.493771+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3a992f5e-3e6b-45d7-a81a-70439bd56b90", "name": "wistful-painted-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 50168, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:29:26.504841+00:00", "ended_at": "2026-08-25T19:29:26.602723+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5001ac5a-f6dc-4c8d-ac2e-8c15ee6af6af", "name": "earnest-fearless-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 47248, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:27:55.652612+00:00", "ended_at": "2026-08-25T19:27:55.779036+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4673ecb6-8717-4bb3-8c78-27f4e727c21f", "name": "quaint-dapper-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 44384, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:26:23.757370+00:00", "ended_at": "2026-08-25T19:26:23.858112+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "89beec0d-5a0c-4e2a-94a3-719ab74ac444", "name": "jovial-forlorn-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 41482, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:24:48.227551+00:00", "ended_at": "2026-08-25T19:24:48.328739+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "aceb0029-8c9c-4bb3-b435-5a9ef3e246d5", "name": "smooth-misty-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 38586, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:23:05.428091+00:00", "ended_at": "2026-08-25T19:23:05.586812+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "19ac9249-014d-4150-8df1-f13daeda218c", "name": "civil-clever-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 35662, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:21:23.074913+00:00", "ended_at": "2026-08-25T19:21:23.199941+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "89d38659-71ec-476e-b3b1-faf7f62f7c56", "name": "jolly-amber-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 60984, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:19:42.244950+00:00", "ended_at": "2026-08-25T19:19:42.361187+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "97712556-3d09-44d8-ab54-a00198da3e91", "name": "northern-wooded-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 58050, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:18:03.385088+00:00", "ended_at": "2026-08-25T19:18:03.530841+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b9cb567b-002f-4b1a-98b9-eff27a74e700", "name": "early-amiable-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 55116, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:16:26.016292+00:00", "ended_at": "2026-08-25T19:16:26.221125+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "eff0f88b-4fa8-47f9-89a5-090dbb6ecb67", "name": "gilded-sunlit-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 52188, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:14:51.394235+00:00", "ended_at": "2026-08-25T19:14:51.542002+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "aeba7ade-faee-4071-9f61-706d5b502b0a", "name": "spirited-nameless-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 49228, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:13:25.059140+00:00", "ended_at": "2026-08-25T19:13:25.157583+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ac973fe7-49c5-4571-9cd2-571d5342cfcf", "name": "upland-eager-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 46272, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:11:49.620136+00:00", "ended_at": "2026-08-25T19:11:49.726295+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9b37a7fe-75d1-447f-89de-5e801e6c5077", "name": "ashen-keen-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 43290, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:10:15.346168+00:00", "ended_at": "2026-08-25T19:10:15.517273+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "103ea184-ce16-4805-ac61-22bfaa3fcdc8", "name": "austere-umber-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 40300, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:08:38.771992+00:00", "ended_at": "2026-08-25T19:08:38.899328+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "82df36e9-4bf3-4655-9d61-b092c9695bae", "name": "humble-supple-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 37354, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:06:58.095947+00:00", "ended_at": "2026-08-25T19:06:58.205688+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cc41de48-8a13-4670-901a-fe998ff8bb77", "name": "quiet-knotted-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 34416, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:05:12.059675+00:00", "ended_at": "2026-08-25T19:05:12.176509+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5009907f-aa9d-4d7e-a5ed-ac7b75b2acfd", "name": "vivid-wiry-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 59742, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:03:32.050312+00:00", "ended_at": "2026-08-25T19:03:32.682697+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5d64b596-f380-43b3-ad91-686045aa0ebd", "name": "orderly-primal-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 56832, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:01:59.683605+00:00", "ended_at": "2026-08-25T19:02:00.168294+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "20527f80-f56f-408e-bb64-1d83b42823f4", "name": "meadow-watchful-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 53912, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T19:00:25.198641+00:00", "ended_at": "2026-08-25T19:00:25.307249+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2002b635-d0fc-43c9-9ed2-5fcc699a9cfa", "name": "lonesome-weathered-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 50990, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:58:48.699064+00:00", "ended_at": "2026-08-25T18:58:48.793315+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b585e2de-33fa-4ade-bb97-3d629c09c0ed", "name": "downy-fierce-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 48074, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:57:18.348278+00:00", "ended_at": "2026-08-25T18:57:18.445145+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8fe7d103-2c48-4410-a063-2ecce1164df1", "name": "quartz-restless-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 45142, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:55:46.699587+00:00", "ended_at": "2026-08-25T18:55:46.844844+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "23b9861f-bf99-4c25-b72b-7bf1ccc72fa8", "name": "mottled-nameless-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 42200, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:54:04.172795+00:00", "ended_at": "2026-08-25T18:54:04.276595+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8cff936c-793b-4200-82a5-effe6d6c3524", "name": "supple-bronzed-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 39270, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:52:16.027643+00:00", "ended_at": "2026-08-25T18:52:16.127651+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "34193fa6-19ea-47b7-b5e3-4874dfa2b19e", "name": "blunt-earnest-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 36368, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:50:26.077573+00:00", "ended_at": "2026-08-25T18:50:26.439001+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0835e1bc-6be9-4a80-bbc9-f610932e6744", "name": "lunar-vernal-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.128.3.201", "src_port": 53096, "username": "test1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 672, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T18:49:44.037854+00:00", "ended_at": "2026-08-25T18:49:44.247737+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3452 }, { "id": "d498bb5e-7b70-4fc3-a659-055417aeef4b", "name": "airy-buoyant-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 33452, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:48:41.843589+00:00", "ended_at": "2026-08-25T18:48:41.946093+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bdeaeea7-fe42-44c0-a461-99c791be3b19", "name": "russet-knotted-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 58720, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:47:03.095259+00:00", "ended_at": "2026-08-25T18:47:03.187031+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9356bcf2-3edd-4edd-ae25-488df06a5a96", "name": "prairie-opal-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 55752, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:45:27.860358+00:00", "ended_at": "2026-08-25T18:45:27.986334+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5ccbeb0e-0ea8-4f42-b4e2-841366f52c90", "name": "peaty-sunlit-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 52784, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:43:50.611796+00:00", "ended_at": "2026-08-25T18:43:50.736646+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e0923ec0-e6c9-4234-bc5f-b42d25456845", "name": "gallant-tangled-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 49854, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:42:19.004725+00:00", "ended_at": "2026-08-25T18:42:19.404112+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2210034b-3a21-4ee8-9fe2-ee455b27f54f", "name": "indigo-electric-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 46900, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:40:41.690385+00:00", "ended_at": "2026-08-25T18:40:41.904015+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2db308db-6c80-472a-96eb-75afe23fd2fe", "name": "coastal-frank-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 43950, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:39:04.552536+00:00", "ended_at": "2026-08-25T18:39:04.662068+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5b5cde9b-d1d6-4096-9ac1-15dcdb300a2c", "name": "faded-quaint-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 41000, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:37:21.381164+00:00", "ended_at": "2026-08-25T18:37:21.496463+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "74322887-3274-44fd-974f-f2ecb4a9e9a0", "name": "slender-genial-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 38046, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:35:35.900478+00:00", "ended_at": "2026-08-25T18:35:36.097018+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4ecefe2c-ac00-424e-915a-216d91779e23", "name": "dutiful-thorny-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 35082, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:33:51.926535+00:00", "ended_at": "2026-08-25T18:33:52.046048+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b5002cc6-86d0-4495-b54c-d5726f23f875", "name": "fabled-gentle-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 60344, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:32:04.206728+00:00", "ended_at": "2026-08-25T18:32:04.321924+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f52e39e8-a95c-4c0c-8def-3d10069f1935", "name": "nautical-vivid-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 57378, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:30:19.994748+00:00", "ended_at": "2026-08-25T18:30:20.110036+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "df524334-ad01-4b3c-9bfd-8a9cdcc8a38c", "name": "fringed-hearty-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 54444, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:28:36.815134+00:00", "ended_at": "2026-08-25T18:28:36.955802+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "dbca3434-e4bc-4aa7-a6aa-c1b6215f8d15", "name": "airy-steady-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 51500, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:26:59.985492+00:00", "ended_at": "2026-08-25T18:27:00.081207+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6a541f7b-14b5-4ffa-8c5c-0387e5145d48", "name": "bronzed-steady-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 48526, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:25:29.048936+00:00", "ended_at": "2026-08-25T18:25:29.143746+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9a3c768a-5f54-466b-b441-ef44d9f34373", "name": "reedy-graceful-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 45538, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:23:59.030467+00:00", "ended_at": "2026-08-25T18:23:59.145540+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "77e10b90-78b8-4be0-b694-848ed93e4b20", "name": "murky-vaulted-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 42546, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:22:29.921855+00:00", "ended_at": "2026-08-25T18:22:30.022747+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f89657d3-6f3a-4e07-a234-55ac786e41b2", "name": "inland-drifting-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 39546, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:21:00.926293+00:00", "ended_at": "2026-08-25T18:21:01.072496+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e93d0b0f-3076-4ba6-a5aa-fb789cc9e73f", "name": "mindful-thrifty-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 36580, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:19:28.645890+00:00", "ended_at": "2026-08-25T18:19:28.743889+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b367c010-44d3-4aaf-bb6c-d6d82c992adc", "name": "shifting-bitter-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 33604, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:17:53.580028+00:00", "ended_at": "2026-08-25T18:17:53.822161+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "272da387-5588-4a61-b2ac-45ed55bc3a9f", "name": "solemn-frank-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 58844, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:16:24.534753+00:00", "ended_at": "2026-08-25T18:16:24.645708+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "20454169-9e27-4468-b944-0b6294b7097c", "name": "alpine-restless-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 55814, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:14:51.287300+00:00", "ended_at": "2026-08-25T18:14:51.530023+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a6c1f181-e7ec-4a37-9c47-ef04d77ecf24", "name": "wistful-oaken-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.217", "src_port": 52800, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T18:13:20.116156+00:00", "ended_at": "2026-08-25T18:13:20.351035+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "43b9e993-c716-4132-b681-791d3f5c4e14", "name": "serene-genial-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 45296, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T16:01:45.239182+00:00", "ended_at": "2026-08-25T16:01:46.715529+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "99b9f023-a9af-4a03-a6d7-e4398d6a3a95", "name": "gallant-alpine-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 43180, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:59:35.176119+00:00", "ended_at": "2026-08-25T15:59:36.606683+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "400fe573-37fa-40dd-b6fb-274b4acfc6e0", "name": "humble-regal-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 41080, "username": "apache", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:57:16.998900+00:00", "ended_at": "2026-08-25T15:57:18.168475+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2997f8c9-34ad-4c65-90eb-977b4595be81", "name": "placid-peaty-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 39024, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:55:11.427797+00:00", "ended_at": "2026-08-25T15:55:12.435236+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f6fa6bb3-e9a7-41b5-a984-9375d70ef223", "name": "keen-dappled-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 36900, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:53:10.281570+00:00", "ended_at": "2026-08-25T15:53:11.986014+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "6d82ce71-bcb7-4b69-8563-25677b6fadc8", "name": "bold-mossy-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 34786, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:51:01.539144+00:00", "ended_at": "2026-08-25T15:51:03.696670+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0c2374db-718f-4b0e-a1a4-bc9dfc414551", "name": "steady-emerald-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 60988, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:48:46.038620+00:00", "ended_at": "2026-08-25T15:48:47.616912+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "33802abc-1678-4fe1-8f70-773f095de3e7", "name": "breezy-courtly-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 58658, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:46:25.414487+00:00", "ended_at": "2026-08-25T15:46:28.688488+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "99f28484-c00d-4cd8-af6a-c41b37e70cb9", "name": "peaty-supple-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 53910, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:41:12.759024+00:00", "ended_at": "2026-08-25T15:41:14.590028+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "71c5d50d-ec1b-4da0-a09a-c12b7490b3ab", "name": "upland-obsidian-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 51464, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:38:40.896714+00:00", "ended_at": "2026-08-25T15:38:48.114566+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "58e38082-1f09-4359-b991-5b4d95126fe0", "name": "brisk-lanky-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 48980, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:36:02.174945+00:00", "ended_at": "2026-08-25T15:36:03.237373+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ff5b8107-faf4-4028-9192-0054af8e9254", "name": "sterling-lunar-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 46508, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:33:24.609800+00:00", "ended_at": "2026-08-25T15:33:25.311900+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e499574f-8603-4d70-a66e-9f7e8353f9e5", "name": "leafy-regal-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 44038, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:30:43.892203+00:00", "ended_at": "2026-08-25T15:30:44.936325+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c890127c-c54c-4216-91fe-5bda7394bf8b", "name": "glacial-nimble-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 41506, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:28:55.381061+00:00", "ended_at": "2026-08-25T15:28:55.746481+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "47420ea3-913e-4de6-bc62-fec164aaba9a", "name": "dewy-bronzed-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 38926, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:26:54.076606+00:00", "ended_at": "2026-08-25T15:26:54.456493+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8406a5f6-1352-4ecc-b3bb-1cfaace0260d", "name": "early-northern-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 36284, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:25:00.002773+00:00", "ended_at": "2026-08-25T15:25:01.019813+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1386dd89-ce35-499f-9d78-fb99cb2ee2ac", "name": "vernal-gnarled-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 33654, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:22:50.871578+00:00", "ended_at": "2026-08-25T15:22:52.330297+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "90a1d3e7-b9c0-486f-8485-a5c5512ae92c", "name": "ruddy-daring-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 59248, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:20:40.385167+00:00", "ended_at": "2026-08-25T15:20:41.378418+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "dd104333-b49a-440d-9048-b1eb1b922de7", "name": "plucky-fearless-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 56586, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:18:17.209841+00:00", "ended_at": "2026-08-25T15:18:19.356079+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "80f51cb3-0ee3-4820-8481-ef7d2659ed37", "name": "crisp-hardy-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 53910, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:15:56.526328+00:00", "ended_at": "2026-08-25T15:15:57.192064+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "34bccadf-848c-4366-aade-baf9b2a5d246", "name": "fierce-knotted-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 51234, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:13:27.398756+00:00", "ended_at": "2026-08-25T15:13:29.169799+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e58755e0-9325-4478-af8f-50a8aa5c03b2", "name": "steady-buoyant-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 48524, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:11:09.944083+00:00", "ended_at": "2026-08-25T15:11:11.193506+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8a2c2f38-4225-446b-b94e-c8b0dfcb982d", "name": "canny-meadow-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 45838, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:08:38.801590+00:00", "ended_at": "2026-08-25T15:08:40.156944+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "de3b7188-c4cf-48a6-adf8-0880e9017804", "name": "clever-mighty-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 43154, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:06:18.223604+00:00", "ended_at": "2026-08-25T15:06:18.986870+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1d1749a6-25fb-472c-b8f8-25399a3db7b0", "name": "indigo-lively-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 40458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:03:59.612823+00:00", "ended_at": "2026-08-25T15:04:00.206388+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8a8e6c99-ff0f-4f2a-b071-881d10f3d383", "name": "arctic-amber-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 37724, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T15:01:34.841529+00:00", "ended_at": "2026-08-25T15:01:35.720904+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fd783ec7-423a-474c-86f4-d13e004b86f8", "name": "cunning-barren-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 35032, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:59:10.122302+00:00", "ended_at": "2026-08-25T14:59:12.019700+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2a4c1dda-ad99-4cb5-b90d-96758a1ba85a", "name": "meadow-gentle-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 60544, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:56:40.301495+00:00", "ended_at": "2026-08-25T14:56:41.264419+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0c9e8bf5-65c2-4d9c-938b-31d8d044774b", "name": "autumn-amber-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 57778, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:54:12.275908+00:00", "ended_at": "2026-08-25T14:54:12.616139+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8eb73e06-ab37-4044-afc3-8f091ffd649c", "name": "mighty-graceful-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 54086, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:51:44.781121+00:00", "ended_at": "2026-08-25T14:51:44.891810+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "31e71795-3591-4e15-a0bf-3043ebbfd761", "name": "candid-downy-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 50982, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:49:11.007061+00:00", "ended_at": "2026-08-25T14:49:11.829224+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "be04608d-c609-4f51-9908-687ff7ec87a4", "name": "kindly-shaded-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 47868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:46:18.452579+00:00", "ended_at": "2026-08-25T14:46:19.162686+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "60b53259-9c56-4de0-b7df-e294c4eb6ffb", "name": "placid-frosty-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 44744, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:43:17.339665+00:00", "ended_at": "2026-08-25T14:43:18.175590+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "75473b3c-7b11-4578-b143-bf6d32d9ff04", "name": "gnarled-brave-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 41610, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:40:15.111756+00:00", "ended_at": "2026-08-25T14:40:16.168399+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1e24a0e6-61c9-4037-8514-08a805c27580", "name": "cheerful-bashful-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.57.122.168", "src_port": 38490, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T14:37:24.312742+00:00", "ended_at": "2026-08-25T14:37:25.039209+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "02a89e4b-0910-4990-96c9-bce5bab983df", "name": "restless-vigilant-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "216.10.242.215", "src_port": 49222, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 618, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T12:51:28.687254+00:00", "ended_at": "2026-08-25T12:51:28.877929+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3437 }, { "id": "e94bbb20-9ab1-4579-83a3-b31d8d25d26c", "name": "snowy-prickly-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "185.158.22.150", "src_port": 51641, "username": "eric", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T12:00:45.324526+00:00", "ended_at": "2026-08-25T12:00:45.482622+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3891 }, { "id": "0edee1f6-c125-4bb5-8dfd-c1b37a4fc167", "name": "leafy-keen-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.12.221.15", "src_port": 46600, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T11:09:45.835620+00:00", "ended_at": "2026-08-25T11:09:45.928858+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3739 }, { "id": "651ec677-83a6-4d7f-b33e-6e77280c89dc", "name": "scarlet-candid-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.102.98.53", "src_port": 38006, "username": "es1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 65, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T09:51:04.655389+00:00", "ended_at": "2026-08-25T09:51:04.662733+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3254 }, { "id": "1ec638cc-b33e-4be7-8f52-047ca1789644", "name": "painted-idle-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "76.79.213.70", "src_port": 51068, "username": "erpnext", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T08:53:26.661515+00:00", "ended_at": "2026-08-25T08:53:26.784419+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4161 }, { "id": "ee9d9728-bdcb-4943-b9e5-368e21f93454", "name": "whispering-hazy-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "98.70.50.166", "src_port": 41214, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T08:52:46.484465+00:00", "ended_at": "2026-08-25T08:52:46.663187+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3815 }, { "id": "c9ca2c84-e599-4dfd-b40a-92acfaa16497", "name": "stormy-pewter-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.191.5", "src_port": 46574, "username": "redmine", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 381, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T03:04:54.158569+00:00", "ended_at": "2026-08-25T03:04:54.269691+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3561 }, { "id": "6c288a83-82f2-47ed-a792-94189ee56870", "name": "lofty-sandy-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 40810, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:49:54.917294+00:00", "ended_at": "2026-08-25T02:49:55.886660+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d83e41ee-7aff-4b99-b4fb-b4845e4bf1a9", "name": "wandering-sandy-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 39218, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:49:04.119767+00:00", "ended_at": "2026-08-25T02:49:05.016279+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f4f198d5-c959-44d4-91ef-2d526d7e0cf8", "name": "tawny-candid-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 37612, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:48:15.037713+00:00", "ended_at": "2026-08-25T02:48:15.583104+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5cfad719-5940-4e65-8ca9-ffc61a613108", "name": "hardy-blazing-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 36032, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:47:26.771066+00:00", "ended_at": "2026-08-25T02:47:27.591451+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "204cb439-4f02-41d0-b670-8b9990c43dce", "name": "jolly-electric-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 34440, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:46:37.775852+00:00", "ended_at": "2026-08-25T02:46:38.563157+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5cb37829-c0d4-4ef9-a5de-7c26b33792d9", "name": "plush-ivory-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 32848, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:45:50.627796+00:00", "ended_at": "2026-08-25T02:45:51.139474+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7cdb61c1-6e63-4aa1-8790-a351eb0865bb", "name": "glassy-steady-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 59476, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:45:02.583273+00:00", "ended_at": "2026-08-25T02:45:03.371184+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f067ea16-3872-4a73-ab92-63b6cc3b7233", "name": "ginger-fierce-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 57886, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:44:17.546184+00:00", "ended_at": "2026-08-25T02:44:18.062923+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "628bdbdb-b0f0-4910-9c5e-abf1ffdb8dbc", "name": "russet-tawny-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 56276, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:43:32.276679+00:00", "ended_at": "2026-08-25T02:43:32.813221+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8b4c865a-b0eb-41d2-b5cd-7741fee7fae5", "name": "reedy-sunlit-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 54698, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:42:49.270784+00:00", "ended_at": "2026-08-25T02:42:50.147380+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8034b095-7903-4496-93ef-27746e810c60", "name": "idle-lunar-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 53092, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:42:06.326104+00:00", "ended_at": "2026-08-25T02:42:07.212241+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "41c3df55-ac96-4aba-bb27-a4d2c7118320", "name": "blithe-ashen-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 51492, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:41:24.517886+00:00", "ended_at": "2026-08-25T02:41:25.024093+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "538fc910-94f9-4d45-a769-4579a03ee4e2", "name": "mighty-rustic-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 49880, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:40:42.968987+00:00", "ended_at": "2026-08-25T02:40:43.409252+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "96592306-ea83-4947-8ed4-ea89a0030a2c", "name": "quiet-mindful-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 48274, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:39:59.816000+00:00", "ended_at": "2026-08-25T02:40:00.761033+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "13afb689-8adf-4654-8559-b6f5a980c1c0", "name": "northern-cosmic-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 46666, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:39:16.100667+00:00", "ended_at": "2026-08-25T02:39:16.926647+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fc026f9b-1424-41ce-97c1-5d3927e397f6", "name": "bashful-feathered-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 45038, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:38:34.964484+00:00", "ended_at": "2026-08-25T02:38:35.669948+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "e2b26a09-3369-40cb-8138-e835e3ff71ae", "name": "bronzed-gleaming-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 43426, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:37:53.868603+00:00", "ended_at": "2026-08-25T02:37:54.502748+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3bf6bb8e-fe5a-483c-8432-110c87efe1d0", "name": "vernal-marine-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 41830, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:37:06.626292+00:00", "ended_at": "2026-08-25T02:37:07.416604+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "918fac3e-d72e-44f8-b4c6-a575b2e5bdca", "name": "quiet-wistful-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 40224, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:36:16.908082+00:00", "ended_at": "2026-08-25T02:36:17.599014+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "dbfd6efc-af80-4556-bb29-5a22dccecd61", "name": "bitter-gilded-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 38630, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:35:24.029969+00:00", "ended_at": "2026-08-25T02:35:24.716279+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "01eae106-265c-45a0-ba44-85c27f12da8a", "name": "lawful-hollow-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 37016, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:34:34.173052+00:00", "ended_at": "2026-08-25T02:34:35.200725+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c81b3f39-3c06-4cf3-bf44-c3e4345d6be2", "name": "serene-icy-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 35394, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:33:43.674170+00:00", "ended_at": "2026-08-25T02:33:44.222493+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "b9ded582-b5ac-4db3-9ca1-5354f9918da5", "name": "oaken-glacial-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 33778, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:32:52.170847+00:00", "ended_at": "2026-08-25T02:32:53.148338+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "27ba15cd-e4ae-42bf-9386-93b7f07c6e50", "name": "fringed-fleeting-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 60428, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:32:01.319694+00:00", "ended_at": "2026-08-25T02:32:02.157409+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "81f9cda5-1a5f-41bc-98e7-4dce09cac107", "name": "sincere-wistful-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 58800, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:31:14.160228+00:00", "ended_at": "2026-08-25T02:31:14.579316+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f6b556b6-e547-4d29-832e-10897c449c89", "name": "vigilant-quiet-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51298, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 162, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:31:06.791025+00:00", "ended_at": "2026-08-25T02:31:10.673509+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cd149294-b1b4-4513-be8d-d34731d746d4", "name": "boreal-freckled-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52968, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 162, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:58.160958+00:00", "ended_at": "2026-08-25T02:31:01.303487+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "77d58daa-94cf-447a-adc1-17384e3cd04c", "name": "murky-rustic-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55638, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 161, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:56.409023+00:00", "ended_at": "2026-08-25T02:30:59.510426+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f72d7efa-6883-4c98-8ee5-1e2424dc47b3", "name": "shaded-regal-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55610, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:46.755426+00:00", "ended_at": "2026-08-25T02:30:50.115557+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "19cea55f-694d-49e2-9ebd-fadd0f4c61f3", "name": "cheerful-tender-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59678, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:37.768512+00:00", "ended_at": "2026-08-25T02:30:43.148797+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dcec45b4-2c5e-498c-9c83-b5754b7483d3", "name": "blithe-sunlit-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49404, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:32.452113+00:00", "ended_at": "2026-08-25T02:30:36.861002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e34fba6-31e4-4829-afe5-556c9d4397f4", "name": "calm-lucid-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 57188, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:30:26.719204+00:00", "ended_at": "2026-08-25T02:30:27.701835+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "46c81f6a-3a58-4ac0-912a-d0e7e5a79e02", "name": "glassy-smooth-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56514, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:25.302196+00:00", "ended_at": "2026-08-25T02:30:28.537538+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b274d4c-ad6b-4ad4-968f-f59820ea8796", "name": "northern-serene-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45604, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:20.702087+00:00", "ended_at": "2026-08-25T02:30:24.496316+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1c2d9b44-6239-4c6b-b8b5-f43ef59a7c30", "name": "thrifty-snowy-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45586, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:14.395186+00:00", "ended_at": "2026-08-25T02:30:20.208044+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2cc73a68-48c3-48ad-833a-081d8e3bcd83", "name": "hazy-misty-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42380, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:30:07.008090+00:00", "ended_at": "2026-08-25T02:30:12.785726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6108e3f4-2c5b-422d-bc80-e3cbd2cff9ce", "name": "wooded-rambling-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49690, "username": "marcu1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:55.405172+00:00", "ended_at": "2026-08-25T02:30:02.201355+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "70f78842-fd96-4751-8c7e-505869e4c04c", "name": "solar-slender-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38222, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:55.208118+00:00", "ended_at": "2026-08-25T02:30:00.421530+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0877a6c5-d4c6-4b82-8549-40d00784f3fe", "name": "frank-sleepy-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48858, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:42.497218+00:00", "ended_at": "2026-08-25T02:29:45.711665+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6835d768-9621-4124-a6e7-26718ac4a175", "name": "amber-hearty-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 55584, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:29:39.714774+00:00", "ended_at": "2026-08-25T02:29:40.273591+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f5b8e611-f855-4867-b332-6ddd0bc9f68b", "name": "serene-crystal-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48848, "username": "user4", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:36.998362+00:00", "ended_at": "2026-08-25T02:29:43.115498+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "0e326662-f26f-45d3-8d1e-f035dc66e812", "name": "wandering-early-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33228, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:18.228064+00:00", "ended_at": "2026-08-25T02:29:23.502527+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9bad5330-ae3f-4e8a-9b5c-1947b2715c43", "name": "whispering-murky-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41514, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:14.506148+00:00", "ended_at": "2026-08-25T02:29:18.128961+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03088ea4-e573-48c7-b671-480a0b454546", "name": "woven-gentle-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49818, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:29:00.603233+00:00", "ended_at": "2026-08-25T02:29:03.499264+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "655e92d0-e336-4df6-b6e9-8c2e6387753d", "name": "dusky-deft-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41044, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:59.204603+00:00", "ended_at": "2026-08-25T02:29:05.105064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e27052e8-c517-48d5-a0fa-12edcbdcd0a3", "name": "meadow-silent-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 53952, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:28:54.296214+00:00", "ended_at": "2026-08-25T02:28:55.453384+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1eea793b-670d-40e7-bc9a-d56000ee5975", "name": "meadow-icy-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45144, "username": "lucas", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:52.619219+00:00", "ended_at": "2026-08-25T02:28:58.702185+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "11c8a4ad-2582-448a-b688-aba88fc96dbb", "name": "kindly-nautical-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45106, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:39.797766+00:00", "ended_at": "2026-08-25T02:28:44.816622+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8565e781-b49b-418c-803b-2f9112f7da56", "name": "curious-solemn-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39358, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:33.399176+00:00", "ended_at": "2026-08-25T02:28:39.426159+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae32346a-8fe1-4045-aabd-07f200d86709", "name": "blazing-dutiful-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36480, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:22.111513+00:00", "ended_at": "2026-08-25T02:28:27.120008+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "59a4caf9-ef8f-43c9-9a69-9ad5def1e47e", "name": "lunar-polar-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38364, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:17.707322+00:00", "ended_at": "2026-08-25T02:28:22.996886+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "60e6b835-7179-4a8c-bd08-c76d60b34524", "name": "gritty-faded-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 52344, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:28:08.709655+00:00", "ended_at": "2026-08-25T02:28:09.140352+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2c423ca4-1bbc-40e0-9cb3-14ab26461de5", "name": "gnarled-mindful-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46722, "username": "ark", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:06.810815+00:00", "ended_at": "2026-08-25T02:28:13.801355+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "cfa15f2f-aed5-4e93-94fa-27299fcde9cd", "name": "austere-brave-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46712, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:28:00.695400+00:00", "ended_at": "2026-08-25T02:28:03.708116+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3569e8c8-6714-4f90-83e7-e0f9e71f63ed", "name": "patient-sooty-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51144, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:27:50.707083+00:00", "ended_at": "2026-08-25T02:27:55.630493+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0c1a511d-b50f-480c-8c05-f2cab8007dfd", "name": "stoic-lanky-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56724, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:27:44.007435+00:00", "ended_at": "2026-08-25T02:27:49.284758+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8edfdd2-f16c-4bde-94d1-d6d125930240", "name": "earnest-hearty-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55686, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:27:30.095242+00:00", "ended_at": "2026-08-25T02:27:36.421052+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86c20925-60d8-4a18-ba04-1c5408aeaf02", "name": "ancient-whispering-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54858, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:27:28.017232+00:00", "ended_at": "2026-08-25T02:27:32.215920+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5db54136-34e8-4bba-b914-ee235c5ed09b", "name": "twilight-balmy-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 50732, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:27:23.946477+00:00", "ended_at": "2026-08-25T02:27:24.935078+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3fdc0180-1c30-41e8-b3a4-5009db71eb27", "name": "prairie-vernal-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46370, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:27:16.709099+00:00", "ended_at": "2026-08-25T02:27:22.399467+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "572bac11-41c9-48a4-a254-f4ddcdac9923", "name": "amber-balmy-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38500, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:27:06.810255+00:00", "ended_at": "2026-08-25T02:27:11.899362+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f4ee2fc-70c3-420c-a62b-d919e32544dc", "name": "distant-jaunty-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37782, "username": "kevin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:56.729078+00:00", "ended_at": "2026-08-25T02:27:02.404187+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "cd803fb3-eaf2-4875-a0fb-2cdee28f55e3", "name": "russet-noble-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38492, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:54.825107+00:00", "ended_at": "2026-08-25T02:26:57.901585+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9115e52c-83eb-420e-a7c9-2b048d8a6157", "name": "vigilant-brave-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51120, "username": "orange", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:49.903776+00:00", "ended_at": "2026-08-25T02:26:58.006144+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ed032924-66de-4f78-a5e3-44af0f5a0ddf", "name": "nautical-loyal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59958, "username": "botuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:39.816231+00:00", "ended_at": "2026-08-25T02:26:45.413542+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "a46f0b81-eb63-4641-8146-70596b49af67", "name": "chilly-sincere-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40954, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:36.897000+00:00", "ended_at": "2026-08-25T02:26:40.328410+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0aaabc75-547c-416e-83b8-a9f2db0b4b18", "name": "thorny-distant-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 49116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:26:36.102238+00:00", "ended_at": "2026-08-25T02:26:36.703632+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f954c4a6-723f-4c27-8a97-1dff2352b4c1", "name": "shifting-hollow-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59940, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:21.698174+00:00", "ended_at": "2026-08-25T02:26:24.899558+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3338589f-aa1d-422b-8d89-6f6bc1ddac1a", "name": "earnest-gilded-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49460, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:09.523267+00:00", "ended_at": "2026-08-25T02:26:14.905064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c99234b9-a84f-41ae-be77-884ab60e7f41", "name": "restless-amiable-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43548, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:26:00.118726+00:00", "ended_at": "2026-08-25T02:26:05.196954+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba334be4-b9eb-463e-90d8-7524a625e772", "name": "balmy-idle-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60008, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:51.499941+00:00", "ended_at": "2026-08-25T02:25:54.517064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c59c9d2b-422e-4035-bda0-3434581e14b6", "name": "mellow-fearless-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 47494, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:25:46.314748+00:00", "ended_at": "2026-08-25T02:25:47.013085+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d08b28a7-0257-4b64-9d7c-e5d87bb1f26e", "name": "ivory-sturdy-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34804, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:45.504178+00:00", "ended_at": "2026-08-25T02:25:49.225596+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "838354a1-a27b-43a9-9b5a-ddd337cdf34c", "name": "inland-clever-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38852, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:41.806104+00:00", "ended_at": "2026-08-25T02:25:46.502631+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad3e51e5-ee3e-4d96-98c4-3ade251073a6", "name": "sunlit-solar-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38826, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:31.520472+00:00", "ended_at": "2026-08-25T02:25:34.906204+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "16b84be1-1f14-491c-a737-e7306a125f0d", "name": "coastal-quartz-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55764, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:19.517590+00:00", "ended_at": "2026-08-25T02:25:25.517116+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bdd711ce-fc44-4852-a695-5b38aefa2eb9", "name": "curious-ancient-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35214, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:15.398452+00:00", "ended_at": "2026-08-25T02:25:19.317304+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "15beb3c0-cd7c-47f3-8e48-bc9e8d75e335", "name": "curious-wandering-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53492, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:25:00.098310+00:00", "ended_at": "2026-08-25T02:25:04.902564+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "15362ab5-6020-443d-a119-372c344bb6f3", "name": "fleeting-ashen-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 45876, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:24:55.455138+00:00", "ended_at": "2026-08-25T02:24:55.981830+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f1d4feaf-9f41-4000-af6d-8f273c992917", "name": "nameless-idle-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47502, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:24:54.806449+00:00", "ended_at": "2026-08-25T02:24:59.691431+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "032d2c73-d095-4c13-9faf-15ca2bbeef1f", "name": "orderly-nameless-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47480, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:24:53.407617+00:00", "ended_at": "2026-08-25T02:24:58.610324+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d071cc77-fcff-4bea-96a6-017342e1ec33", "name": "granite-nautical-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35694, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:24:35.910922+00:00", "ended_at": "2026-08-25T02:24:41.716882+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "17668ff9-3387-413e-89e1-e2c6b58432ff", "name": "sullen-tangled-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55872, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:24:24.208156+00:00", "ended_at": "2026-08-25T02:24:28.486471+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70f97130-6409-4021-a5f9-36608812b176", "name": "dutiful-burly-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48496, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:24:21.406173+00:00", "ended_at": "2026-08-25T02:24:24.197421+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ced4ec92-8bd0-470c-a931-5c1fe94d9a92", "name": "mottled-autumn-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60508, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:24:11.002433+00:00", "ended_at": "2026-08-25T02:24:13.896069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8a72652a-897e-48b9-8b47-62c549cabc04", "name": "dapper-watchful-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 44248, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:24:06.718916+00:00", "ended_at": "2026-08-25T02:24:07.465783+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1d9d42c6-dfbd-4deb-955c-493c9751aa4d", "name": "calm-woven-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42496, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:59.709318+00:00", "ended_at": "2026-08-25T02:24:06.504900+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1cffcdb2-b6b7-4b14-9db2-c27f82d7b841", "name": "pleasant-stoic-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50462, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:59.620049+00:00", "ended_at": "2026-08-25T02:24:03.913363+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "775ff88d-58dc-45c6-968f-038220377de2", "name": "emerald-merry-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50474, "username": "rock", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:56.715768+00:00", "ended_at": "2026-08-25T02:24:00.509902+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "83cf2896-0c46-429c-b43f-c77a008dfda8", "name": "spirited-zealous-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43044, "username": "sedu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:44.410969+00:00", "ended_at": "2026-08-25T02:23:51.302288+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2374a0c7-a83d-49e8-8bb9-2434630abd81", "name": "wry-dusky-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43300, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:37.526599+00:00", "ended_at": "2026-08-25T02:23:43.594605+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31ff3a50-f668-4146-9da7-b680cfbe5422", "name": "leafy-obsidian-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50312, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:23.102727+00:00", "ended_at": "2026-08-25T02:23:26.991512+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "134c6995-7436-4a48-bbca-16b612c4424d", "name": "daring-seaward-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 42638, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:23:19.590410+00:00", "ended_at": "2026-08-25T02:23:20.213559+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4d8a5988-002b-47cd-8126-cb5a709b0b33", "name": "jagged-creaky-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55630, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:17.291160+00:00", "ended_at": "2026-08-25T02:23:20.901900+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b098b67a-78d9-4ae5-bb04-09d927c1e351", "name": "snowy-silent-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57324, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:03.102906+00:00", "ended_at": "2026-08-25T02:23:06.495099+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "942a69a3-51b6-499f-b384-32c9cf62b159", "name": "cosmic-gritty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55610, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:23:02.605649+00:00", "ended_at": "2026-08-25T02:23:08.200213+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f011b750-2b37-41fe-ad5d-53d98b84d088", "name": "fabled-mindful-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44084, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:22:53.300558+00:00", "ended_at": "2026-08-25T02:22:56.202550+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e83a0a39-502d-4a99-8def-d5a054e41342", "name": "ashen-russet-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47856, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:22:48.699683+00:00", "ended_at": "2026-08-25T02:22:51.883149+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eed284cc-1f8c-4db8-9416-1df607387958", "name": "grassy-dusky-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47182, "username": "vagrant", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:22:34.707124+00:00", "ended_at": "2026-08-25T02:22:42.509423+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "49075008-37da-4e51-b90d-0f307734bed7", "name": "alpine-sullen-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 41028, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:22:31.956500+00:00", "ended_at": "2026-08-25T02:22:32.423964+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ba1e730c-7358-462f-ad84-f05aff457a43", "name": "faded-tender-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56166, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:22:30.206269+00:00", "ended_at": "2026-08-25T02:22:35.904665+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad0ed03c-0f44-4b09-bd5e-9dfc4a77b59d", "name": "frosty-solar-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56158, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:22:28.449882+00:00", "ended_at": "2026-08-25T02:22:33.409325+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "302630c5-5de3-4c9d-ad2e-fd5978aa9129", "name": "candid-daring-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56018, "username": "trade", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:22:10.909265+00:00", "ended_at": "2026-08-25T02:22:14.920806+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4017b5c7-54a2-466f-bd52-f3707ad205f2", "name": "salty-smoky-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43982, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:55.500589+00:00", "ended_at": "2026-08-25T02:21:59.102745+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bbac49e5-7295-4ab5-a8eb-54ba0945d7ba", "name": "icy-glacial-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52616, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:52.790156+00:00", "ended_at": "2026-08-25T02:21:57.210607+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c72ed4aa-7a54-46e3-b862-df449f175f51", "name": "jagged-subtle-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52600, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:45.594861+00:00", "ended_at": "2026-08-25T02:21:49.810855+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31fc013e-0972-48fc-8d6f-52298a4e2d5d", "name": "glassy-lunar-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 39400, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:21:41.355687+00:00", "ended_at": "2026-08-25T02:21:41.932021+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ed6ade0a-0272-4644-b484-d4189eb41ee8", "name": "boreal-plush-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48414, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:36.393836+00:00", "ended_at": "2026-08-25T02:21:40.692184+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "735f9904-1d4b-4615-b439-436a4091c18f", "name": "woven-solar-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39730, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:35.013427+00:00", "ended_at": "2026-08-25T02:21:40.218999+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a491cb43-be43-434e-80e6-8348a0b8df16", "name": "granite-watchful-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45814, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:22.898513+00:00", "ended_at": "2026-08-25T02:21:26.607357+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "583248af-0871-449a-89e0-1066858d36e5", "name": "brave-sunlit-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53568, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:13.605668+00:00", "ended_at": "2026-08-25T02:21:17.523783+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f6bb73d6-4ab8-43f4-b93a-a0eaef8a08cc", "name": "sullen-canny-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48436, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:21:06.628425+00:00", "ended_at": "2026-08-25T02:21:11.798521+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "114c12b2-704c-494d-9281-575e7ef9341a", "name": "honest-brazen-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54178, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:57.899167+00:00", "ended_at": "2026-08-25T02:21:01.495904+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3a03f7b-42ae-4860-b900-143a5007af0a", "name": "jaunty-prairie-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38840, "username": "centreon", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:53.492508+00:00", "ended_at": "2026-08-25T02:21:01.021218+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "25ac8cb0-5a6b-46e3-b5f3-07082e7c135a", "name": "rugged-valiant-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 37758, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:20:52.779088+00:00", "ended_at": "2026-08-25T02:20:53.188705+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2d9c5935-8af1-4637-85ee-5497f1df4d0e", "name": "silent-valiant-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54172, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:50.514387+00:00", "ended_at": "2026-08-25T02:20:53.693176+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31a02673-e9ab-4871-8e02-383ce583b59f", "name": "coastal-sunlit-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51384, "username": "jakob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:38.226115+00:00", "ended_at": "2026-08-25T02:20:44.089364+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "a92ccf77-47c9-4ebc-a41a-5492baba6a9a", "name": "prairie-lunar-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46834, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:30.902953+00:00", "ended_at": "2026-08-25T02:20:37.004399+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bee584ed-9148-483a-904c-eeb7be4a14c9", "name": "dappled-supple-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49340, "username": "doris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:18.623381+00:00", "ended_at": "2026-08-25T02:20:24.618121+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "d6e9121d-0df5-4837-91f0-f50246eb775a", "name": "rambling-plush-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49350, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:20:11.117043+00:00", "ended_at": "2026-08-25T02:20:14.009129+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ffb6da6-f92e-4086-916c-862385561232", "name": "patient-smooth-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 36152, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:20:05.245733+00:00", "ended_at": "2026-08-25T02:20:06.206040+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "61e17eae-b209-49a9-8692-00bc056800f1", "name": "tranquil-hazy-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40078, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:57.600133+00:00", "ended_at": "2026-08-25T02:20:02.608555+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45e32b7b-5dee-49fe-9f27-066a4ee253dd", "name": "ivory-western-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49926, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:49.998274+00:00", "ended_at": "2026-08-25T02:19:52.901263+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd0bb510-e9cf-44e7-b989-fe5f58761143", "name": "humble-quaint-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32998, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:37.907161+00:00", "ended_at": "2026-08-25T02:19:43.120472+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0094144-d11a-46ca-84f5-942c5289f5bd", "name": "peaty-quiet-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51948, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:28.406471+00:00", "ended_at": "2026-08-25T02:19:35.023781+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "4d35bafe-5c63-44e0-bdd3-a27ff7d6788c", "name": "umber-tender-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37482, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 186, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:23.407583+00:00", "ended_at": "2026-08-25T02:19:28.015080+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5736c999-1bbe-44a0-ad4c-22bef52f0e02", "name": "nameless-windswept-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48668, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:16.499905+00:00", "ended_at": "2026-08-25T02:19:21.288250+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "62f2455c-4a0c-4166-a6b5-f87e53ed2141", "name": "ashen-thrifty-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 34544, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:19:16.128415+00:00", "ended_at": "2026-08-25T02:19:17.092694+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "89ed9bf7-e844-4446-94f9-5db027bfc14a", "name": "tangled-plush-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39504, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 227, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:19:02.099197+00:00", "ended_at": "2026-08-25T02:19:05.602654+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "442f9787-9c16-4db4-ae24-e4fd3921ce41", "name": "airy-daring-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39490, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:55.003673+00:00", "ended_at": "2026-08-25T02:18:57.993013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9b529e2-7979-4a55-8dd1-6ca4447152f9", "name": "prickly-meadow-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49002, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:48.033930+00:00", "ended_at": "2026-08-25T02:18:53.050455+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "774e4f9f-49ef-428c-be52-56457fec1177", "name": "electric-umber-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34086, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:45.705568+00:00", "ended_at": "2026-08-25T02:18:48.597418+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "513b7a64-a2af-4789-b8bc-42347ec1bc7e", "name": "prairie-sooty-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49166, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:36.509970+00:00", "ended_at": "2026-08-25T02:18:40.191391+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "93e5e373-92dd-4353-b1a2-b62f2860c092", "name": "inland-prairie-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51534, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:29.709781+00:00", "ended_at": "2026-08-25T02:18:33.825624+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d1ab32e-59c0-4071-98c3-3d752062b27d", "name": "tawny-brisk-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 32934, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:18:27.995874+00:00", "ended_at": "2026-08-25T02:18:28.569814+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c2c3233d-cb46-4fea-b3ba-ee4a30f5208d", "name": "plucky-wistful-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51528, "username": "teste", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:20.004534+00:00", "ended_at": "2026-08-25T02:18:22.802935+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1ec07abe-2503-4c4f-8f40-302827361fd7", "name": "somber-eager-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40384, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:18:11.387246+00:00", "ended_at": "2026-08-25T02:18:15.111760+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "44e55f9a-0974-47b8-874e-a92972cdfb3e", "name": "cosmic-wandering-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49070, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:59.898320+00:00", "ended_at": "2026-08-25T02:18:03.014539+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4cacb190-4f48-4371-bf91-83efc9e253d3", "name": "jaunty-distant-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:54.900804+00:00", "ended_at": "2026-08-25T02:17:59.807243+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37d4b87c-ff4e-4667-8528-87a0ddf2d0f7", "name": "merry-jolly-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40452, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:45.901787+00:00", "ended_at": "2026-08-25T02:17:50.888948+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f2898a70-d0d3-4889-a22c-5e235b4b10f3", "name": "flinty-loyal-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50900, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:42.507517+00:00", "ended_at": "2026-08-25T02:17:48.321298+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e305b9c2-7fbb-4a2f-a2e1-55e27e964a87", "name": "feathered-mindful-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 59564, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:17:41.876359+00:00", "ended_at": "2026-08-25T02:17:42.666268+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "2d48df48-45dd-4449-a79b-68a66e9cb60c", "name": "bashful-wistful-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39956, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:35.634651+00:00", "ended_at": "2026-08-25T02:17:41.344943+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6bcb9f32-4462-4bde-a912-b24b36cd36df", "name": "idle-mindful-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:20.113348+00:00", "ended_at": "2026-08-25T02:17:26.085593+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c21c2de3-0194-4ece-be88-d8b0c42aeaa8", "name": "nautical-wandering-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47278, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:11.933737+00:00", "ended_at": "2026-08-25T02:17:17.730895+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c511403-54a1-4205-b1d0-e06a23529456", "name": "lanky-gloomy-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47272, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:17:05.022372+00:00", "ended_at": "2026-08-25T02:17:07.801641+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b71c804-e541-4695-8327-5063c111968e", "name": "crimson-sooty-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60002, "username": "gns3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:57.003260+00:00", "ended_at": "2026-08-25T02:17:05.024575+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4705c245-6379-4a7b-af62-f997ab496f4e", "name": "blithe-wistful-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 57960, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:16:55.255876+00:00", "ended_at": "2026-08-25T02:16:56.074408+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "846a24d9-8265-46de-a6d5-5e3979f06257", "name": "vivid-twilight-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47668, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:55.009898+00:00", "ended_at": "2026-08-25T02:16:58.212838+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3105f7e0-bf30-4a5d-8162-1d6e5e38a932", "name": "supple-mellow-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57410, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:44.613518+00:00", "ended_at": "2026-08-25T02:16:47.787372+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "518adfc9-b2f1-452e-a301-419a1d5530ac", "name": "gilded-mottled-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41834, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:37.107608+00:00", "ended_at": "2026-08-25T02:16:41.205147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "94a9809b-6e19-4019-9a95-183463d3d740", "name": "misty-oaken-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41822, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:28.811871+00:00", "ended_at": "2026-08-25T02:16:34.493881+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a42476d7-9a1c-469c-966d-4f8ce45364a3", "name": "sandy-lonesome-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41620, "username": "gg", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:27.100636+00:00", "ended_at": "2026-08-25T02:16:35.596051+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "d57634ca-0e53-40b8-81e7-68f8928673d1", "name": "nimble-ashen-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 56344, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:16:10.138098+00:00", "ended_at": "2026-08-25T02:16:11.141489+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "94dddfb2-32de-4cba-a165-f31add498c95", "name": "murky-wry-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53556, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:07.211726+00:00", "ended_at": "2026-08-25T02:16:11.812030+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9502f5f2-9c8c-4ea8-be2b-a322f85385e0", "name": "nautical-sincere-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34288, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:16:05.904016+00:00", "ended_at": "2026-08-25T02:16:10.617187+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d060c462-853c-4043-8f67-6892156e6142", "name": "feral-crisp-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59974, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:54.297829+00:00", "ended_at": "2026-08-25T02:15:57.317392+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "504bac12-fd2a-4d00-a11c-aefae99994d8", "name": "canny-feathered-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55430, "username": "parsa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:44.806748+00:00", "ended_at": "2026-08-25T02:15:49.798082+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "5a510deb-1852-4012-9066-f29a0a652522", "name": "tawny-scarlet-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36714, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:42.300784+00:00", "ended_at": "2026-08-25T02:15:46.715873+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "67cbf836-e5c4-4745-8115-4478bd78a9e4", "name": "gentle-feral-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36698, "username": "elrond", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:42.004850+00:00", "ended_at": "2026-08-25T02:15:46.908044+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b34bba23-f7dd-4331-946f-55b1573eff58", "name": "scarlet-supple-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 54726, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:15:25.120909+00:00", "ended_at": "2026-08-25T02:15:25.877515+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "d035beb1-13c2-4239-b3ae-e61064196400", "name": "frugal-burly-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41876, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:19.604373+00:00", "ended_at": "2026-08-25T02:15:25.309300+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5721bb0a-d5d5-43f5-bc35-4576d2404339", "name": "sooty-distant-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53838, "username": "work", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:13.697665+00:00", "ended_at": "2026-08-25T02:15:19.798073+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cf351a9a-11a7-4894-b7d3-5c94ba55c2dd", "name": "gritty-lofty-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41364, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:15:02.414323+00:00", "ended_at": "2026-08-25T02:15:05.613352+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cbe73dfd-8d26-4304-9402-ddc7c0e42d98", "name": "bitter-nautical-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41352, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:54.214602+00:00", "ended_at": "2026-08-25T02:14:59.709406+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41aa855e-7706-42c5-9d64-92fd4545b344", "name": "glacial-brave-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44988, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:53.926809+00:00", "ended_at": "2026-08-25T02:14:57.510056+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34607441-acfa-4fc0-bf8c-cb38179f08ff", "name": "ashen-scarlet-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54554, "username": "mcserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:53.008883+00:00", "ended_at": "2026-08-25T02:14:58.808027+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "9bd01f8b-f61c-40c9-8d3b-5dbb883c9ae3", "name": "spirited-obsidian-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52036, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:38.903857+00:00", "ended_at": "2026-08-25T02:14:46.303802+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "39a2d418-396e-4025-9e10-fe1a6ba682ff", "name": "bashful-coral-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 53102, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:14:38.643276+00:00", "ended_at": "2026-08-25T02:14:39.106098+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "7153968d-e748-4bb2-8435-80a8c8ce567d", "name": "distant-lunar-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46812, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:34.600022+00:00", "ended_at": "2026-08-25T02:14:40.030226+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85a337a9-d517-4e25-ae60-9c2b38241fff", "name": "restless-vigilant-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34802, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:13.414698+00:00", "ended_at": "2026-08-25T02:14:19.315892+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6ebf26e4-0a7e-4c4c-91a7-34941a580955", "name": "misty-austere-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34786, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:14:02.304220+00:00", "ended_at": "2026-08-25T02:14:05.404369+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c89541d4-d2a5-4150-b79a-331031b164ba", "name": "woven-eager-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33346, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:58.654587+00:00", "ended_at": "2026-08-25T02:14:01.937080+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c471f38c-c514-418e-86dc-0132ae31cd2a", "name": "sooty-zealous-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 51470, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:13:52.073144+00:00", "ended_at": "2026-08-25T02:13:52.843340+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cb993b72-be0a-4d32-926d-74cff7ef4a11", "name": "opal-fickle-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39060, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:48.300971+00:00", "ended_at": "2026-08-25T02:13:51.217483+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d055685-0903-4a26-8029-1292d9de6ec8", "name": "lucid-whispering-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52178, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:44.604174+00:00", "ended_at": "2026-08-25T02:13:49.016400+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7d0f160e-2a1f-4201-b1c0-ad83b18c5e69", "name": "blazing-glacial-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:37.005909+00:00", "ended_at": "2026-08-25T02:13:42.401315+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bc72195d-7c39-463a-a47f-c699c2f16251", "name": "tender-steady-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46572, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:29.901383+00:00", "ended_at": "2026-08-25T02:13:35.311198+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b9f554d-aedb-48fe-b24c-c34b1ab21885", "name": "tangled-languid-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46570, "username": "mohammad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:24.601311+00:00", "ended_at": "2026-08-25T02:13:32.301472+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "a4facd1f-3e8d-4e47-8f88-4177b9776674", "name": "glassy-sunlit-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52206, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:13:11.703760+00:00", "ended_at": "2026-08-25T02:13:14.602450+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "298e887d-55da-4efe-8677-2002408de29b", "name": "prickly-pleasant-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 49874, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:13:06.092963+00:00", "ended_at": "2026-08-25T02:13:06.454920+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0f962dae-0870-41f9-9abb-bf101f6d0967", "name": "indigo-rustic-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53582, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:58.806146+00:00", "ended_at": "2026-08-25T02:13:03.283770+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "772e7b0b-104d-447d-92b9-75c6def13e56", "name": "brave-balmy-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46972, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:56.145549+00:00", "ended_at": "2026-08-25T02:13:01.233906+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d590778e-8b74-4247-9b7d-b3b84d6985b6", "name": "jaunty-eager-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60784, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:47.810749+00:00", "ended_at": "2026-08-25T02:12:50.916196+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45f0ab79-79f6-4c92-b379-71e9956a3335", "name": "coral-dutiful-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60772, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:38.010553+00:00", "ended_at": "2026-08-25T02:12:42.002570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8665b94e-2268-4dc1-8f2c-4c460e22e81e", "name": "quartz-boreal-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47792, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:31.205639+00:00", "ended_at": "2026-08-25T02:12:35.101260+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "66c3b1bf-f440-49a9-b25e-8ce08a89c953", "name": "barren-subtle-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36602, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:25.492086+00:00", "ended_at": "2026-08-25T02:12:30.186751+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "853145ec-34e6-4f72-80e9-c19b2c3879e1", "name": "western-mellow-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 48252, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:12:19.210945+00:00", "ended_at": "2026-08-25T02:12:20.132831+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "cd09f1f4-368f-4be7-98d5-62bf4802a7c9", "name": "vaulted-rapid-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46800, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:11.609745+00:00", "ended_at": "2026-08-25T02:12:14.704439+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86709872-67ed-44a8-8a58-c9d7714b59d8", "name": "sunlit-lunar-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46732, "username": "ossuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:07.200626+00:00", "ended_at": "2026-08-25T02:12:13.727847+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1665 }, { "id": "25dd6793-d010-4934-a192-cdc21cfe515d", "name": "ruddy-daring-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56940, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:12:01.002738+00:00", "ended_at": "2026-08-25T02:12:04.206972+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd8dbae3-980d-4a23-9e8e-f185d907e753", "name": "stoic-rapid-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32894, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:11:36.202938+00:00", "ended_at": "2026-08-25T02:11:39.527350+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b987489e-76f7-4637-ac25-615d3b1e3d68", "name": "gnarled-weathered-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59366, "username": "kali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:11:33.741061+00:00", "ended_at": "2026-08-25T02:11:40.549994+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "ad09fc76-fd32-4430-9e9c-e88c57482f34", "name": "balmy-tidal-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 46636, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:11:31.501920+00:00", "ended_at": "2026-08-25T02:11:32.451121+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "ac67ec99-0580-4f0a-99df-f611bd1fc6a8", "name": "courtly-jaunty-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38730, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:11:29.209054+00:00", "ended_at": "2026-08-25T02:11:34.811252+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c738e43c-e00f-4094-a760-27f3829b456b", "name": "obsidian-subtle-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43586, "username": "Asalem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:11:22.907068+00:00", "ended_at": "2026-08-25T02:11:29.200879+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b2413cce-a6eb-4c50-8fc8-29a9f01d4c10", "name": "quartz-smooth-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35690, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:11:12.591896+00:00", "ended_at": "2026-08-25T02:11:15.530807+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf0d5939-2009-419c-9d73-dc457d1a5e0d", "name": "vigilant-noble-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43574, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:58.216386+00:00", "ended_at": "2026-08-25T02:11:00.914254+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "33bf151a-e9da-40e0-bf74-d00b8fe380eb", "name": "thawing-seaward-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37350, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:54.025902+00:00", "ended_at": "2026-08-25T02:10:56.836742+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0cd1939b-78b7-4727-a54b-08f50cb5822d", "name": "lawful-grassy-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 44998, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:10:44.521350+00:00", "ended_at": "2026-08-25T02:10:45.461295+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fe1d4898-0d3b-4e41-a9d8-af7ce438f563", "name": "mottled-craggy-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51092, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:42.212478+00:00", "ended_at": "2026-08-25T02:10:48.209237+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8ae9acde-f8b3-4e9e-8e35-3faa0b2b0bc1", "name": "russet-bold-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50316, "username": "system", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:40.219034+00:00", "ended_at": "2026-08-25T02:10:45.586638+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b53c60b8-45f3-48c5-af71-fc226570fb81", "name": "peaty-serene-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55524, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:21.793491+00:00", "ended_at": "2026-08-25T02:10:24.905136+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9a30fccb-17cd-4a19-ae6e-7cc36d7152bc", "name": "frank-freckled-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55522, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 193, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:20.502601+00:00", "ended_at": "2026-08-25T02:10:24.617055+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2830d885-6cda-4720-876e-5c84b1642af7", "name": "grassy-placid-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42166, "username": "dani", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 180, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:10:13.397801+00:00", "ended_at": "2026-08-25T02:10:16.820898+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9a4afa45-c6f9-441f-b56b-4b419d4cad88", "name": "silent-feral-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53028, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:58.408766+00:00", "ended_at": "2026-08-25T02:10:02.304682+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fb7d4e60-209b-463f-af03-6d51a752d34e", "name": "quaint-hushed-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 43356, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:09:56.657118+00:00", "ended_at": "2026-08-25T02:09:57.174631+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "361e8f26-406d-4a09-b129-523a17f1ee14", "name": "golden-scarlet-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45880, "username": "gabriel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:55.102090+00:00", "ended_at": "2026-08-25T02:10:00.911621+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "88adf3c2-75f3-41aa-b8d9-123ec2c760ff", "name": "dusty-fringed-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50460, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 181, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:44.805445+00:00", "ended_at": "2026-08-25T02:09:47.617418+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "190c2346-1583-4157-b22b-aa3a96a78c04", "name": "muted-vigilant-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51798, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:33.489063+00:00", "ended_at": "2026-08-25T02:09:36.292457+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e7ec9218-0be4-426d-9298-1998ed361ca5", "name": "plucky-peaty-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51794, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:30.309119+00:00", "ended_at": "2026-08-25T02:09:33.320041+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bc1646ed-b1f6-49bc-afb5-21a4487bba1a", "name": "gallant-tidal-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54076, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:15.619350+00:00", "ended_at": "2026-08-25T02:09:21.123947+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "853401c1-46c8-465e-9461-be706499ca8f", "name": "mottled-windswept-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36728, "username": "usuario", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:15.607887+00:00", "ended_at": "2026-08-25T02:09:23.400496+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "8d32f8ca-964b-466c-b5c2-4c70860e76d2", "name": "gnarled-nimble-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 41736, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:09:08.060274+00:00", "ended_at": "2026-08-25T02:09:08.446413+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3afa32bf-4580-4de4-a59e-ffd90c47b80c", "name": "shaded-snowy-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42362, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:09:05.217166+00:00", "ended_at": "2026-08-25T02:09:08.928795+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f7f2744-de3a-48ac-b669-db691d0e6a13", "name": "grumpy-daring-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54110, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:57.197846+00:00", "ended_at": "2026-08-25T02:09:03.216525+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4c81c7a2-c427-41bd-aeef-0ce8f5eb9712", "name": "fringed-languid-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56926, "username": "manoj", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:46.003215+00:00", "ended_at": "2026-08-25T02:08:53.012471+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "1f1c25c5-2d0f-4331-a519-a70c1970c97a", "name": "quartz-shaded-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56930, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:45.996881+00:00", "ended_at": "2026-08-25T02:08:51.998028+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a5084f6c-da11-4d5b-8cc8-2ecdb5c42a4d", "name": "pewter-amber-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56190, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:30.904708+00:00", "ended_at": "2026-08-25T02:08:35.722706+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4f8b05ae-c345-4e4b-832d-812784ee5f7b", "name": "dutiful-jaunty-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37786, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:28.505851+00:00", "ended_at": "2026-08-25T02:08:34.292743+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "31214e8e-1c6c-4634-9813-7a5ebf88835c", "name": "fierce-upland-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47304, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:19.593969+00:00", "ended_at": "2026-08-25T02:08:25.512582+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41e0e101-3168-46cc-8aa2-f36c6f2e7573", "name": "bashful-russet-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 40082, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:08:19.345526+00:00", "ended_at": "2026-08-25T02:08:20.099232+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "01ba56fe-1b6f-4e0f-b1f1-d0271a5522bf", "name": "fierce-scarlet-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39678, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:08:04.990751+00:00", "ended_at": "2026-08-25T02:08:11.000967+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f7844ab-ec32-49f5-97a4-08760e291c7f", "name": "inland-brazen-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54620, "username": "calvin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:57.933321+00:00", "ended_at": "2026-08-25T02:08:04.654696+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b5079580-6257-4ec6-b414-054d18db94f9", "name": "muted-quaint-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54622, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:53.501154+00:00", "ended_at": "2026-08-25T02:07:57.385675+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7b36690a-d4c4-4a84-be27-24bc454b52fa", "name": "fearless-amiable-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49174, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:41.442157+00:00", "ended_at": "2026-08-25T02:07:46.938951+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c31d35c0-56d6-491b-8339-929dab996262", "name": "rustic-zealous-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 38456, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:07:27.365874+00:00", "ended_at": "2026-08-25T02:07:27.800589+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bae60acd-a6af-404c-a8de-5fb733947ecb", "name": "patient-muted-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53268, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:26.624028+00:00", "ended_at": "2026-08-25T02:07:29.311916+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2c41d3c9-051f-460e-a60b-17deb438cbef", "name": "hazy-graceful-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54354, "username": "sdadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:24.421753+00:00", "ended_at": "2026-08-25T02:07:31.401237+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "e3d0cf33-3f0c-4137-a9b3-21164676a126", "name": "brazen-nautical-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52006, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:20.898624+00:00", "ended_at": "2026-08-25T02:07:23.922569+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3a09eae-20ee-49eb-a615-4fbc1ac534aa", "name": "frosty-balmy-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48480, "username": "kafka", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:08.117912+00:00", "ended_at": "2026-08-25T02:07:15.822035+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "7426bcb7-cfaf-47dc-bc46-6b612cc5f6e8", "name": "mossy-wooded-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50320, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:07:06.625101+00:00", "ended_at": "2026-08-25T02:07:10.709287+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3dbfa80f-09ed-4d72-9a0a-996eeb2d1384", "name": "emerald-zealous-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48250, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:06:56.208130+00:00", "ended_at": "2026-08-25T02:06:59.337058+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74328c76-808c-45a9-b344-447c4cc42fdd", "name": "knotted-sooty-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48246, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:06:39.794388+00:00", "ended_at": "2026-08-25T02:06:42.728956+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef6b3f86-6b01-4a59-a52a-3fe828c796fe", "name": "plush-rambling-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 36840, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:06:36.786181+00:00", "ended_at": "2026-08-25T02:06:37.831073+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "0789e07a-ba0a-44f2-bc0c-9270c6d90ed7", "name": "marbled-bashful-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42408, "username": "airflow", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:06:36.011561+00:00", "ended_at": "2026-08-25T02:06:43.927514+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "6fdbca44-528e-41b3-b3e5-3d01b64b90f3", "name": "mossy-eager-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47982, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:06:19.215317+00:00", "ended_at": "2026-08-25T02:06:22.811154+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10e535e1-eedd-409e-b401-3efa2ba06b6f", "name": "gnarled-thorny-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33710, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:06:13.794954+00:00", "ended_at": "2026-08-25T02:06:18.708854+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "814f960c-4dd6-43b3-bde5-009e01d5fc74", "name": "sturdy-sleepy-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38454, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:06:04.711770+00:00", "ended_at": "2026-08-25T02:06:08.826008+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2279881-58f2-4dd1-8991-1ee66122e892", "name": "golden-sullen-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47080, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:53.030878+00:00", "ended_at": "2026-08-25T02:05:56.237897+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db3a0bde-8825-4340-9d5b-8c5b4b076093", "name": "marine-woven-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47064, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:48.728776+00:00", "ended_at": "2026-08-25T02:05:53.122099+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "191e6109-775f-4c30-a0d9-89de623938a2", "name": "distant-kindly-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 35190, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:05:45.908392+00:00", "ended_at": "2026-08-25T02:05:46.741796+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "28a9a380-670f-4f93-bce0-4760c65e586a", "name": "creaky-idle-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36520, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:40.017109+00:00", "ended_at": "2026-08-25T02:05:46.403224+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "4817ff0c-ecae-408c-994b-832c81d45cd6", "name": "glacial-russet-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42630, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:39.205189+00:00", "ended_at": "2026-08-25T02:05:44.220014+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bee1cf4-827e-4bab-a4b9-88488b39936f", "name": "rambling-sunlit-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33600, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:25.299079+00:00", "ended_at": "2026-08-25T02:05:31.304794+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5beffed9-3a30-4308-8cf4-4c1d349dfed4", "name": "woven-glassy-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58840, "username": "core", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:19.195950+00:00", "ended_at": "2026-08-25T02:05:24.298135+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "6fea57dc-8d7e-435b-b883-e7fda2ff5b0a", "name": "dusty-quartz-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59430, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:04.200746+00:00", "ended_at": "2026-08-25T02:05:09.894565+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0519bea-9229-4113-9932-f14f91b83c74", "name": "wandering-hidden-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59410, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:05:02.007135+00:00", "ended_at": "2026-08-25T02:05:05.311416+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2816e21-72eb-4d0c-92f1-de8e37740550", "name": "eager-loyal-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 33560, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:04:55.177365+00:00", "ended_at": "2026-08-25T02:04:55.582185+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "9f48e819-428c-4726-b4b7-80da263dde53", "name": "bronzed-hidden-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52912, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:04:45.890305+00:00", "ended_at": "2026-08-25T02:04:51.996436+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ebba3a8-a966-4b3d-96cd-de42866a0f32", "name": "ginger-ashen-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48208, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:04:43.704211+00:00", "ended_at": "2026-08-25T02:04:48.109462+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8f679cd-1679-45d5-8f09-e86352009dd8", "name": "sturdy-breezy-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42232, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:04:35.306538+00:00", "ended_at": "2026-08-25T02:04:38.330611+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e49cada-b21b-4305-89a7-457bb4e64abc", "name": "murky-stoic-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44404, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:04:25.197002+00:00", "ended_at": "2026-08-25T02:04:28.102905+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7cde876c-49b6-4058-b981-06dc4735ad27", "name": "hazy-sooty-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33322, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:04:11.100018+00:00", "ended_at": "2026-08-25T02:04:16.905016+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cc2c4d76-768f-4dd3-a21f-eeb43a05d505", "name": "dappled-sleepy-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33320, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:04:08.206769+00:00", "ended_at": "2026-08-25T02:04:13.837132+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2afa26a9-d2ca-49cb-aea9-1ed28bc25cd1", "name": "nautical-western-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 60146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:04:06.685307+00:00", "ended_at": "2026-08-25T02:04:07.287992+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c1fc5403-c996-416f-b55c-0990189c875c", "name": "lucid-buoyant-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56618, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:52.392832+00:00", "ended_at": "2026-08-25T02:03:55.196382+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9408cf2e-4715-409e-af7a-e2b0878771f1", "name": "crimson-whispering-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59126, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:51.198262+00:00", "ended_at": "2026-08-25T02:03:54.528026+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "213b4c0a-4f47-4604-a2d9-18562e9a8dfb", "name": "crystal-patient-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52438, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:43.798373+00:00", "ended_at": "2026-08-25T02:03:47.709416+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9321707c-3ca0-4dbc-90ca-bb8cdb6b7c94", "name": "loyal-hollow-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56404, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:28.411970+00:00", "ended_at": "2026-08-25T02:03:31.292250+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "624f46c6-89c1-474c-8eee-c94f518f11d1", "name": "sturdy-misty-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50780, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:27.012314+00:00", "ended_at": "2026-08-25T02:03:31.848965+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e404feaa-a3d7-457b-aed1-62d9d7742071", "name": "painted-wandering-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56394, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:23.000412+00:00", "ended_at": "2026-08-25T02:03:26.690939+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0176fe95-0dd9-4394-9190-78f0db806c79", "name": "velvet-vivid-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 58502, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:03:18.661561+00:00", "ended_at": "2026-08-25T02:03:19.571125+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f6e66b4c-b16c-4369-a19c-02d8be59eb47", "name": "vigilant-obsidian-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55860, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:15.390915+00:00", "ended_at": "2026-08-25T02:03:21.004705+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "022b142b-aff1-411f-bc1b-3d9cdc11780a", "name": "gleaming-peaty-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34600, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:03:01.205459+00:00", "ended_at": "2026-08-25T02:03:06.694406+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "254c4643-8850-4da8-af74-6b0995305e92", "name": "vernal-glacial-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50832, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:56.313688+00:00", "ended_at": "2026-08-25T02:03:02.190237+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0fc6398f-882f-42ed-9c4e-3b6a527b2aea", "name": "western-pewter-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56656, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:45.300251+00:00", "ended_at": "2026-08-25T02:02:48.302694+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0fa7ba5-a8cb-49dd-8924-55941f87c64b", "name": "sincere-vernal-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57812, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:36.425050+00:00", "ended_at": "2026-08-25T02:02:42.024450+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "222b4bba-95da-470b-9f50-f30312d31b98", "name": "valiant-quaint-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 56852, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:02:32.270929+00:00", "ended_at": "2026-08-25T02:02:33.132506+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "5613aee2-4fa4-41e5-95db-902bcfa1e9fb", "name": "emerald-lucid-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57800, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:24.331351+00:00", "ended_at": "2026-08-25T02:02:27.721851+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "afae1612-0efb-499c-a653-936660499b67", "name": "frugal-sterling-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52600, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:21.907391+00:00", "ended_at": "2026-08-25T02:02:27.484882+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3b2df93-337e-4ca3-ac70-fdb0bda0dfb2", "name": "marine-opal-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37152, "username": "wizard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:09.390388+00:00", "ended_at": "2026-08-25T02:02:15.201667+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b01d43cf-ef35-4822-b323-b1b4ee6580e4", "name": "marbled-vernal-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34454, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:02:09.117309+00:00", "ended_at": "2026-08-25T02:02:14.796069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "60674a19-17d3-4e77-b54d-e93f37fa7e58", "name": "wistful-whispering-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36770, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:57.096415+00:00", "ended_at": "2026-08-25T02:01:59.900466+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e03e2c83-fddd-45e5-9a5d-57e13c794fad", "name": "sincere-silent-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36756, "username": "esroot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:56.504219+00:00", "ended_at": "2026-08-25T02:02:04.609510+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "96582114-ba91-46f3-9270-937a440fec3c", "name": "sooty-blunt-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60720, "username": "potok", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:46.795622+00:00", "ended_at": "2026-08-25T02:01:52.600632+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "67ad2434-82d6-4c44-a586-78652faf6b7b", "name": "sullen-civil-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 55230, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:01:45.874463+00:00", "ended_at": "2026-08-25T02:01:46.264682+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "bd42da47-3429-41a9-8b8c-d4ceb76fafea", "name": "faded-stoic-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50778, "username": "drcomadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:38.618848+00:00", "ended_at": "2026-08-25T02:01:46.011651+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "91ce2fc1-c232-4e57-a8b4-405d2af4bae0", "name": "jovial-gritty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41662, "username": "csgo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:33.409148+00:00", "ended_at": "2026-08-25T02:01:39.603209+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "fdfc8148-dede-41d1-b89b-7fdd27dc146f", "name": "dewy-sterling-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60130, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:14.604177+00:00", "ended_at": "2026-08-25T02:01:19.007875+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e5bc274-a84b-4c43-816e-b049054e01b9", "name": "velvet-jovial-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39642, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 220, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:01:02.691642+00:00", "ended_at": "2026-08-25T02:01:08.001655+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2108e947-782f-4387-be31-5ac996c00095", "name": "shifting-bronzed-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 53590, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:01:01.316525+00:00", "ended_at": "2026-08-25T02:01:02.166394+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4d6356c8-42a6-4ef7-af43-6dd19beef8b2", "name": "kindly-bashful-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58968, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:59.097268+00:00", "ended_at": "2026-08-25T02:01:03.621706+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2d6b53b8-e310-4004-b887-ed989f46d4b6", "name": "weathered-lunar-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58682, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:44.437712+00:00", "ended_at": "2026-08-25T02:00:47.599312+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f756d1ed-5b2f-409a-b181-92fd179527fd", "name": "civil-russet-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58966, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:40.208669+00:00", "ended_at": "2026-08-25T02:00:44.521454+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fde0512c-60a3-42e7-a958-8c19f45d80aa", "name": "rapid-mighty-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55162, "username": "hu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:32.016276+00:00", "ended_at": "2026-08-25T02:00:35.311015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "68c2d61a-5534-4a8c-b10a-a7b645956944", "name": "rustic-fierce-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39482, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:28.718946+00:00", "ended_at": "2026-08-25T02:00:33.333038+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a90e6560-0a20-4152-bb0d-86b2cc7a9cb2", "name": "zealous-twilight-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 51978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T02:00:19.188514+00:00", "ended_at": "2026-08-25T02:00:20.200006+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "288ed572-a1e2-4b0f-98ac-bde9668b7143", "name": "shifting-forlorn-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42296, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:11.997812+00:00", "ended_at": "2026-08-25T02:00:15.491767+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "986c07c4-23ce-4465-99d8-85487729e7c9", "name": "oaken-electric-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42308, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T02:00:11.215459+00:00", "ended_at": "2026-08-25T02:00:16.104616+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "96aae095-8198-4393-9916-d66cb95cab0f", "name": "lofty-snowy-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55046, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 207, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:54.799383+00:00", "ended_at": "2026-08-25T01:59:57.683326+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b057bdf2-6de8-4818-aa62-92b70c7d2b21", "name": "verdant-brave-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42322, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:45.029307+00:00", "ended_at": "2026-08-25T01:59:48.691027+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ec4384c-d317-48c2-9c49-9f86aeca6d1e", "name": "lively-wooded-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46038, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:43.216128+00:00", "ended_at": "2026-08-25T01:59:48.708002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "702e4665-4e76-4288-ba86-658cae9a4d55", "name": "umber-fickle-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 50364, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:59:35.350475+00:00", "ended_at": "2026-08-25T01:59:35.922094+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "3fa3300e-18a5-4c80-9e5a-b7c4e0c254e5", "name": "sunlit-gleaming-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51176, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:33.798055+00:00", "ended_at": "2026-08-25T01:59:37.397235+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0280057a-1ecc-4eac-bb04-9c36e15a8df3", "name": "jovial-pewter-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56816, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:28.503490+00:00", "ended_at": "2026-08-25T01:59:31.403477+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "68d02658-8304-46ce-93bf-dd32fdaa2411", "name": "windswept-plush-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56788, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:20.015489+00:00", "ended_at": "2026-08-25T01:59:24.606625+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b297845f-6990-4d57-b497-e2f97e0a8474", "name": "seaward-crisp-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47556, "username": "ali", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:19.699426+00:00", "ended_at": "2026-08-25T01:59:28.004797+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "6cefded6-dad4-4f87-9bcb-af15cca78e6f", "name": "knotted-vaulted-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56136, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:59:05.092377+00:00", "ended_at": "2026-08-25T01:59:07.710179+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85bf57b6-0b42-45f0-a65e-932fb0618296", "name": "humble-feathered-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41422, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:54.705834+00:00", "ended_at": "2026-08-25T01:58:58.927039+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ca1a9da-0585-49d5-83cb-477df0c84970", "name": "shifting-lofty-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 48752, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:58:53.208070+00:00", "ended_at": "2026-08-25T01:58:53.306387+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "fc0140ed-691d-43dd-b755-20eb1ee29e09", "name": "rambling-brazen-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44670, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:42.993440+00:00", "ended_at": "2026-08-25T01:58:48.488184+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "acaaf3d3-dcff-479c-b297-4bee12d6cf17", "name": "candid-spirited-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44686, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:41.901481+00:00", "ended_at": "2026-08-25T01:58:47.393909+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c816ac7-a61d-411f-b64c-caa6f759fcae", "name": "coral-feathered-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49888, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:31.708034+00:00", "ended_at": "2026-08-25T01:58:37.615425+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "26f79e30-d690-477e-a869-13bb0f586909", "name": "tidal-graceful-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51874, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:20.114499+00:00", "ended_at": "2026-08-25T01:58:23.614251+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bbc20102-323f-4117-8a83-17aed5ff0ce2", "name": "cobalt-noble-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37970, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:11.213060+00:00", "ended_at": "2026-08-25T01:58:15.015069+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f6146f7-3327-4f65-b6e6-2701e4e9f692", "name": "clever-wiry-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 47116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:58:10.509773+00:00", "ended_at": "2026-08-25T01:58:10.600310+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f8e806bd-6f40-41dd-a19d-10622ae3188b", "name": "blunt-rambling-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50720, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:06.613546+00:00", "ended_at": "2026-08-25T01:58:10.637036+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "37289324-7947-4eb5-93d6-34e8861a0b02", "name": "drifting-lawful-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54302, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:58:01.509530+00:00", "ended_at": "2026-08-25T01:58:05.308227+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e5896f55-d05f-46e7-99b4-35c6c12f4ad0", "name": "candid-polar-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54298, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:46.328471+00:00", "ended_at": "2026-08-25T01:57:49.001041+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd0dd29e-0b33-496e-ade3-b64b733609e5", "name": "brisk-wandering-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49176, "username": "coder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:46.225209+00:00", "ended_at": "2026-08-25T01:57:52.604193+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d65e78f4-3821-4a15-9445-035e89256654", "name": "steady-nameless-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35266, "username": "kipt", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:40.812103+00:00", "ended_at": "2026-08-25T01:57:48.903910+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "c8d3e3eb-b6b6-4370-a556-5ecf108f8131", "name": "gentle-bold-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 45478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:57:28.832344+00:00", "ended_at": "2026-08-25T01:57:28.927064+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "95808eff-975c-40d9-a4bb-acd3b1f5bdd9", "name": "feathered-seaward-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39408, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:16.612011+00:00", "ended_at": "2026-08-25T01:57:20.310193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f6f71a1d-62ea-474e-8c38-307bc8bf4cf1", "name": "thrifty-alpine-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37426, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:11.895090+00:00", "ended_at": "2026-08-25T01:57:17.211339+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "91f75067-34a8-416b-aa49-6efb4691053d", "name": "regal-hardy-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37422, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:05.401349+00:00", "ended_at": "2026-08-25T01:57:11.408613+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e21bc9c6-32f8-445e-b362-552fedcf9c71", "name": "jagged-sincere-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43932, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:57:02.313165+00:00", "ended_at": "2026-08-25T01:57:08.337240+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "752ae6c0-a6d4-4eae-b198-ce02c3ce3355", "name": "obsidian-steady-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:50.921465+00:00", "ended_at": "2026-08-25T01:56:56.019587+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a856763-be50-4c80-9a93-6009278aea44", "name": "lawful-restless-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 43836, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:56:50.827103+00:00", "ended_at": "2026-08-25T01:56:51.049388+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "f898f7ac-9c39-4b9b-ace7-5569c8d68290", "name": "nameless-feathered-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57962, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:43.311920+00:00", "ended_at": "2026-08-25T01:56:47.197792+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "820adc2d-37d3-4d83-a5a0-919b2823e776", "name": "jolly-downy-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51594, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:31.912274+00:00", "ended_at": "2026-08-25T01:56:35.129917+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5c3b24fe-e398-4ee6-b40c-de402911dd13", "name": "jagged-northern-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36522, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:21.607310+00:00", "ended_at": "2026-08-25T01:56:24.908390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b375e113-7d70-4d17-a0db-252b64eac709", "name": "emerald-slender-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:18.704610+00:00", "ended_at": "2026-08-25T01:56:23.327795+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f959d867-7f54-4a72-a710-57ae5c6052d7", "name": "indigo-snowy-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 42170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:56:08.728330+00:00", "ended_at": "2026-08-25T01:56:08.830963+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "1e0b5982-cddb-4805-a2cb-6499c4aa7e13", "name": "hearty-regal-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37098, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:08.115939+00:00", "ended_at": "2026-08-25T01:56:13.333129+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "508d27bc-64ff-433a-9bc5-f4e757d0eb7f", "name": "tranquil-candid-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42144, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:56:05.315099+00:00", "ended_at": "2026-08-25T01:56:11.304205+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8732435c-f810-4aba-8337-571011b8c5f8", "name": "frank-reedy-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54208, "username": "zlm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:56.904286+00:00", "ended_at": "2026-08-25T01:56:02.904957+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e11f2efa-e329-4686-a518-83d7d189faf4", "name": "genial-fierce-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34262, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:44.799362+00:00", "ended_at": "2026-08-25T01:55:50.604886+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a203533a-0ae1-4a0a-980f-7e74804f3c71", "name": "sunlit-plush-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57468, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 181, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:40.511586+00:00", "ended_at": "2026-08-25T01:55:45.695483+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10465927-d703-4296-b0db-a04f5b71947a", "name": "ginger-weathered-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:23.599436+00:00", "ended_at": "2026-08-25T01:55:26.499110+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dea92f08-e22c-4dcb-aa66-7df9cd476c8b", "name": "gallant-wry-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 40520, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:55:22.552464+00:00", "ended_at": "2026-08-25T01:55:22.642292+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "8f1c2ac3-246f-4413-bd57-0d60487fcdac", "name": "gnarled-patient-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35634, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:18.196586+00:00", "ended_at": "2026-08-25T01:55:23.603610+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "69c088f4-9507-4625-bb09-0297928940ec", "name": "ruddy-languid-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37542, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:11.710419+00:00", "ended_at": "2026-08-25T01:55:16.000052+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d46fd50-3ee9-4bf4-8c8c-fc34042d0f5d", "name": "jolly-mottled-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56810, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:55:00.598407+00:00", "ended_at": "2026-08-25T01:55:05.311850+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3dfc6cdc-0e49-4e86-a32e-7ea7fac3da8b", "name": "zealous-slender-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48000, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:55.098556+00:00", "ended_at": "2026-08-25T01:54:58.627403+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7101e2e-b5de-4fb4-9222-36a8de8a6bc5", "name": "muted-sunlit-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47998, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:48.612515+00:00", "ended_at": "2026-08-25T01:54:51.990854+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "74c96eb3-b24f-4f92-96f0-e695a5d15fcd", "name": "early-drifting-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 38836, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:54:35.823763+00:00", "ended_at": "2026-08-25T01:54:35.915188+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "4f9c85c6-4ffa-48e5-9ac6-57203594d899", "name": "deft-pleasant-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36476, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:33.893429+00:00", "ended_at": "2026-08-25T01:54:38.100935+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0627ebf2-bae4-4050-8768-2841b90f5e47", "name": "boreal-plucky-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46400, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:30.806311+00:00", "ended_at": "2026-08-25T01:54:35.712941+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "411e3593-ef83-4f45-ad9a-602681e25efd", "name": "gallant-fickle-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35068, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:23.300083+00:00", "ended_at": "2026-08-25T01:54:27.606255+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "32c42575-b59b-496f-b132-8b2a340c1a1b", "name": "grassy-jagged-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34566, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:15.213106+00:00", "ended_at": "2026-08-25T01:54:19.984276+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c381e351-6c1e-4729-9d73-d32af67e6acc", "name": "cosmic-candid-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45492, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:54:05.098790+00:00", "ended_at": "2026-08-25T01:54:10.826102+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a0ce689-f42e-4cf6-a320-298dce286b2c", "name": "deft-leafy-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45462, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:53.691894+00:00", "ended_at": "2026-08-25T01:53:57.634915+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "97eb79b1-06d2-47f8-ba84-80c34e3c830c", "name": "plush-knotted-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38474, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:52.118307+00:00", "ended_at": "2026-08-25T01:53:57.034589+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "79429a92-15d2-4e0d-804b-5519eb277a88", "name": "thawing-vivid-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 37154, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:53:49.728672+00:00", "ended_at": "2026-08-25T01:53:49.850014+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "a0e26c1c-23ec-4c97-ba10-350a4965fc18", "name": "prairie-smooth-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55524, "username": "mc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:49.101070+00:00", "ended_at": "2026-08-25T01:53:54.605347+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "68747ea3-c80e-4024-9e13-f33b744801c6", "name": "mindful-slender-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:38.836052+00:00", "ended_at": "2026-08-25T01:53:43.518248+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e6b7b4c7-2977-497f-be09-b752e61751fd", "name": "craggy-sandy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36322, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:23.614462+00:00", "ended_at": "2026-08-25T01:53:27.121166+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04109869-980f-47e8-9c40-f52bc59840ff", "name": "frank-shaded-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53244, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:16.697961+00:00", "ended_at": "2026-08-25T01:53:19.723722+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "71b579c8-68b6-4444-b1a7-f6f3e74e1365", "name": "ivory-chilly-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53234, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:14.410354+00:00", "ended_at": "2026-08-25T01:53:18.834577+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "313773fd-fc11-444e-bd37-6160c08fa9f6", "name": "diligent-alpine-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48886, "username": "ftpuser1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:53:05.021604+00:00", "ended_at": "2026-08-25T01:53:10.602311+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ceb9f58b-ccb1-492f-a667-38128202fab1", "name": "stoic-frosty-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.110.232", "src_port": 35478, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"", "started_at": "2026-08-25T01:53:04.584954+00:00", "ended_at": "2026-08-25T01:53:04.690425+00:00", "ended_reason": "exec complete", "commands": 4, "transcript_bytes": 13092 }, { "id": "c266398d-a527-4713-9947-c1945a13709d", "name": "faded-mighty-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49372, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:59.418735+00:00", "ended_at": "2026-08-25T01:53:04.197414+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "640bf268-0019-421f-86d3-23c62545ab33", "name": "frosty-crystal-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54426, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:39.606952+00:00", "ended_at": "2026-08-25T01:52:42.613902+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "df8536e3-aca7-4b93-8c93-8d12696b5904", "name": "smoky-chilly-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51436, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:32.306573+00:00", "ended_at": "2026-08-25T01:52:36.816705+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80f08099-5102-4054-817d-cc67d6d47ea2", "name": "hardy-opal-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52976, "username": "hamed", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:28.112511+00:00", "ended_at": "2026-08-25T01:52:35.503273+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "c2964242-b375-4c09-a97c-e873a5e80d11", "name": "amiable-icy-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52978, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:25.108615+00:00", "ended_at": "2026-08-25T01:52:30.205376+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db95ecf5-f861-4ffe-80e0-19a159495e9e", "name": "tidal-bitter-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48214, "username": "omm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:14.089522+00:00", "ended_at": "2026-08-25T01:52:19.901448+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "82f76d5b-09de-413c-a792-dd53af2fb0cb", "name": "idle-subtle-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33736, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:52:07.690477+00:00", "ended_at": "2026-08-25T01:52:12.991389+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce123b8a-3bc0-4df6-871a-d31102f40104", "name": "creaky-dappled-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34358, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:54.406722+00:00", "ended_at": "2026-08-25T01:52:00.307323+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3036610d-21d5-4740-b7c0-828ad259f1ed", "name": "tawny-calm-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41214, "username": "data", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:50.902771+00:00", "ended_at": "2026-08-25T01:51:57.902896+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2b943d3a-c549-4591-8754-fde523ed66f2", "name": "canny-hidden-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41212, "username": "admins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:47.398692+00:00", "ended_at": "2026-08-25T01:51:54.315925+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d2fe4efd-3bf8-4b5a-93ad-c58bde3fe79c", "name": "mottled-shifting-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52292, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:33.297571+00:00", "ended_at": "2026-08-25T01:51:36.505291+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "840d29cc-74a9-447c-b795-7bad1a87c740", "name": "mindful-whispering-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46358, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:26.995288+00:00", "ended_at": "2026-08-25T01:51:31.886003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "599b3380-75a1-4710-8820-b054fbbd8876", "name": "upland-nameless-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39938, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:17.115761+00:00", "ended_at": "2026-08-25T01:51:23.116878+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8174639-3d61-416c-8c2f-6c700658829c", "name": "early-frank-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52414, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:51:08.198361+00:00", "ended_at": "2026-08-25T01:51:14.102160+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ecb724cf-7554-447c-b8d0-f4b8ba93ffe9", "name": "ancient-distant-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43854, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 180, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:55.401444+00:00", "ended_at": "2026-08-25T01:50:59.126351+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "89f79a1c-0eb1-4f06-becb-d742fb4293e6", "name": "daring-murky-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43840, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:55.017002+00:00", "ended_at": "2026-08-25T01:51:01.632188+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "843cd527-c2cd-4efb-bcf4-76d6709c1583", "name": "sunlit-fringed-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43220, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:40.904664+00:00", "ended_at": "2026-08-25T01:50:47.010375+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3a06a0f-8138-4d92-9ccb-55159e7acc1b", "name": "dappled-fringed-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42672, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:28.106481+00:00", "ended_at": "2026-08-25T01:50:32.199068+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d0ed1666-04fa-459f-a716-99f77acad748", "name": "polar-rustic-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53520, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:21.498323+00:00", "ended_at": "2026-08-25T01:50:26.818104+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c56dba54-92b2-493d-b5b4-66e18a97eabd", "name": "weathered-bold-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49958, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:18.821401+00:00", "ended_at": "2026-08-25T01:50:23.195837+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8dfa37a-0984-4443-a288-3e9c1ec3c05a", "name": "brazen-noble-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54682, "username": "tactical", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:08.009571+00:00", "ended_at": "2026-08-25T01:50:14.323735+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ff9d14a9-ea9e-480d-8da2-ccdbcc7c9b03", "name": "ivory-rustic-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53484, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:50:04.303143+00:00", "ended_at": "2026-08-25T01:50:07.906141+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7be27737-2351-4a0b-ac78-bbf1da0bcd01", "name": "mighty-seaward-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57154, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:53.202863+00:00", "ended_at": "2026-08-25T01:49:57.209197+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cdb19316-8304-43ca-8161-0ba9cba6a6a1", "name": "smooth-stormy-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48076, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:48.996773+00:00", "ended_at": "2026-08-25T01:49:52.921074+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01e5eb6e-05a3-49ed-adc1-c85a7b5ca1ff", "name": "icy-meadow-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44804, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:33.885669+00:00", "ended_at": "2026-08-25T01:49:37.409219+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31ef9a99-c232-4f1f-a08b-391348d9073c", "name": "pewter-civil-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52172, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:26.495966+00:00", "ended_at": "2026-08-25T01:49:31.617570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f2939518-e802-4330-84cc-0b1dfcc97886", "name": "gentle-ruddy-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52156, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:16.704754+00:00", "ended_at": "2026-08-25T01:49:21.995546+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "637ef547-a9e6-44ce-b908-e1af5ca087fb", "name": "languid-faded-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47434, "username": "lin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:12.705834+00:00", "ended_at": "2026-08-25T01:49:20.204216+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e64aec5d-c8e8-471d-84d2-70c7c84cd462", "name": "spirited-ruddy-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42610, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:49:08.499833+00:00", "ended_at": "2026-08-25T01:49:13.612149+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "53ff107d-17eb-43e0-80dd-a2963a859de8", "name": "genial-glacial-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58354, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:59.216564+00:00", "ended_at": "2026-08-25T01:49:04.326971+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d754d8da-c81a-4f46-9237-1ca8e0be53e5", "name": "hazy-feral-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58010, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:44.905842+00:00", "ended_at": "2026-08-25T01:48:47.703409+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01ce410a-8bf1-4090-9365-ad9b142206e6", "name": "glacial-quartz-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42206, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:42.808080+00:00", "ended_at": "2026-08-25T01:48:51.514360+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ed6484ab-9656-448e-bf71-8320c70b5868", "name": "earnest-muted-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58002, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:32.301606+00:00", "ended_at": "2026-08-25T01:48:35.812867+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06d89bc0-6de4-4604-b3a9-26ede1074b3b", "name": "jovial-marbled-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43878, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:28.000189+00:00", "ended_at": "2026-08-25T01:48:35.110289+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "4c95c643-718e-404c-b5f2-0de9b17024bb", "name": "oaken-meadow-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37036, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:17.113373+00:00", "ended_at": "2026-08-25T01:48:23.006532+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "717301de-c3ef-4052-b6e2-cd52196ec60e", "name": "lunar-lucid-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36624, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:48:06.902258+00:00", "ended_at": "2026-08-25T01:48:09.708317+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c85e4f6d-d87f-4f9c-9039-354303369f6f", "name": "verdant-gallant-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36610, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:56.001393+00:00", "ended_at": "2026-08-25T01:47:59.798002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed27149c-82f4-4b72-a511-6c3133e70d10", "name": "obsidian-russet-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49462, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:49.910666+00:00", "ended_at": "2026-08-25T01:47:54.811334+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7afdf3c1-fba5-41c7-b257-afa11ade383b", "name": "brisk-tidal-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39138, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:44.108178+00:00", "ended_at": "2026-08-25T01:47:50.200595+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "987d3637-1208-4d4b-a04d-c5135c92c4c9", "name": "northern-lanky-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39506, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:29.232771+00:00", "ended_at": "2026-08-25T01:47:32.442308+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b2ff54ce-790b-4c0a-bda7-fa462c539e2b", "name": "granite-noble-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45280, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:20.424452+00:00", "ended_at": "2026-08-25T01:47:26.394591+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dc39eb10-d0d5-45f5-a8d1-a51bf7a6d8bb", "name": "sterling-deft-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40056, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:17.615758+00:00", "ended_at": "2026-08-25T01:47:21.400768+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "60f3855f-13f3-4d17-9ddc-1d23d5dd2d18", "name": "weathered-golden-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58882, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:47:09.812629+00:00", "ended_at": "2026-08-25T01:47:15.409627+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34033b13-01e0-4594-9393-c1a367d03a7c", "name": "boreal-balmy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60330, "username": "vpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:57.597777+00:00", "ended_at": "2026-08-25T01:47:03.601426+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "bc7a1933-4ede-425c-92cc-5f1ffa90f354", "name": "burly-fabled-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58866, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:57.305529+00:00", "ended_at": "2026-08-25T01:47:02.621373+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8a205cb-5d84-4016-a56b-8dbe898c2399", "name": "bold-lanky-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33712, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:39.592388+00:00", "ended_at": "2026-08-25T01:46:44.416347+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58991426-e404-452e-abc2-60436d5945fc", "name": "clever-upland-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58496, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:33.334959+00:00", "ended_at": "2026-08-25T01:46:39.131148+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6c5ab3f8-2d08-4102-bab7-16de981a1b48", "name": "sooty-cobalt-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33626, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:29.997942+00:00", "ended_at": "2026-08-25T01:46:33.498322+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1487198b-2cf8-41e3-81d7-fe740c75435f", "name": "humble-dutiful-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35944, "username": "clawdbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:14.696176+00:00", "ended_at": "2026-08-25T01:46:22.621202+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "22a3ca12-5a55-4ab5-8f8f-fcf12008f47e", "name": "valiant-windswept-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35946, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:10.608028+00:00", "ended_at": "2026-08-25T01:46:15.813200+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a2df21aa-205a-4987-88f9-d9666b44d87d", "name": "honest-tangled-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46048, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:46:02.697543+00:00", "ended_at": "2026-08-25T01:46:05.516856+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f16c192-b06a-482c-9b18-a82d202316ce", "name": "gleaming-northern-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43642, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 176, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:45:49.909692+00:00", "ended_at": "2026-08-25T01:45:53.219844+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "03e27321-d3d4-48c7-ac61-35c5c3420c7d", "name": "languid-nautical-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39084, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:45:47.291886+00:00", "ended_at": "2026-08-25T01:45:53.288623+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42aa86f0-8f1c-4a9f-97e1-c8939944855f", "name": "barren-prickly-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39042, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:45:38.425951+00:00", "ended_at": "2026-08-25T01:45:44.521179+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "33a9e77e-a29d-40e3-b15a-6902b9156529", "name": "bitter-arctic-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49704, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:45:26.518386+00:00", "ended_at": "2026-08-25T01:45:31.190395+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ecd3c26c-2faf-4442-bb16-a1620c97bfd2", "name": "keen-noble-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49700, "username": "t1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:45:24.106916+00:00", "ended_at": "2026-08-25T01:45:32.804395+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "bb31e485-9a62-4eb2-9c53-c40e8c5c5940", "name": "rugged-distant-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43316, "username": "customer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:45:12.314811+00:00", "ended_at": "2026-08-25T01:45:19.705958+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "7134e719-32a0-4e07-94d8-1a0e4d40f05a", "name": "leafy-canny-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38990, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:59.199860+00:00", "ended_at": "2026-08-25T01:45:03.305397+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f6877f33-ed0d-4612-86c2-b12e20522f40", "name": "creaky-lanky-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49908, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:54.306940+00:00", "ended_at": "2026-08-25T01:44:59.421537+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "489d484c-7768-408f-9a4e-cff07f22a94f", "name": "murky-zealous-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44382, "username": "arthur", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:51.111564+00:00", "ended_at": "2026-08-25T01:44:58.402073+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "30e465b1-3636-4473-b790-8c5c6cb3b68e", "name": "smoky-snowy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44370, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:50.618070+00:00", "ended_at": "2026-08-25T01:44:56.310780+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "589d2c0b-c5af-4a9a-86c7-dd89d155f7b4", "name": "clever-northern-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42216, "username": "term2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:33.103059+00:00", "ended_at": "2026-08-25T01:44:39.294814+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e0d65379-db39-46ec-acde-b0cbbd9736dd", "name": "pewter-hushed-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44182, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:20.835967+00:00", "ended_at": "2026-08-25T01:44:25.318058+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2ceff320-83ea-4d27-8d5e-68ecd7f1fdbc", "name": "kindly-hushed-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54720, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:14.011424+00:00", "ended_at": "2026-08-25T01:44:19.929873+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "26c1f3e0-bfbb-45c7-8774-07a6c65f64ea", "name": "dutiful-thorny-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43770, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:11.307341+00:00", "ended_at": "2026-08-25T01:44:14.017711+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b734462e-a2c1-426f-b63f-dee0ed913e9f", "name": "airy-bronzed-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39032, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:44:00.105336+00:00", "ended_at": "2026-08-25T01:44:03.798112+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5a5caa38-8e61-46b4-be67-bc797b9a12c4", "name": "nameless-dewy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39026, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:43:47.497568+00:00", "ended_at": "2026-08-25T01:43:53.494782+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9f3018d-2274-44f0-b103-82ad186ec145", "name": "lunar-sunlit-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43282, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:43:43.012913+00:00", "ended_at": "2026-08-25T01:43:47.014769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c6541b6f-16c5-492d-abb2-d17c03655899", "name": "rapid-solemn-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57946, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:43:32.720316+00:00", "ended_at": "2026-08-25T01:43:38.604731+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ce32f19-7143-49b5-8c0f-588edffd4d81", "name": "tranquil-boreal-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37062, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:43:24.507040+00:00", "ended_at": "2026-08-25T01:43:30.534489+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dac2c101-896d-4323-a876-a87b16b23ded", "name": "wistful-cunning-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57376, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:43:16.160564+00:00", "ended_at": "2026-08-25T01:43:19.314035+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8afd66a-577c-4f96-8497-0c7de5c562fc", "name": "fickle-steady-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57356, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:43:09.700342+00:00", "ended_at": "2026-08-25T01:43:14.919425+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c89bb2b-0aa1-42d7-9171-7e2cc8dfaaf9", "name": "brave-deft-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41504, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 182, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:56.398079+00:00", "ended_at": "2026-08-25T01:43:00.328683+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4e076f02-7c93-40ca-a565-3c103358860c", "name": "valiant-amiable-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58874, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:51.004920+00:00", "ended_at": "2026-08-25T01:42:55.912428+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4719fb99-c57c-4112-8b56-f94f1cc6cba2", "name": "idle-mossy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40334, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:43.928290+00:00", "ended_at": "2026-08-25T01:42:48.608675+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e55cfbb6-29d8-4a8b-b017-6d7dc65b5ee7", "name": "airy-hushed-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53384, "username": "bernard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:41.320087+00:00", "ended_at": "2026-08-25T01:42:47.504896+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "36b3a550-af17-4547-9985-3801760f0307", "name": "mellow-drifting-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46836, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:26.909619+00:00", "ended_at": "2026-08-25T01:42:31.110372+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a14caf2-5302-4967-aab5-0c70c9358ac9", "name": "eager-buoyant-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46830, "username": "dspace", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:23.508517+00:00", "ended_at": "2026-08-25T01:42:29.108879+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ea9e1986-f816-4231-b5a6-01c31cc6568e", "name": "prairie-cheerful-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58840, "username": "test3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:17.316110+00:00", "ended_at": "2026-08-25T01:42:24.008545+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "18237aa9-8ae6-4985-b96d-22c813a16b5d", "name": "grumpy-mighty-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54332, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:42:04.811941+00:00", "ended_at": "2026-08-25T01:42:08.293036+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "585e687e-c1b5-4c04-9243-6e7625c73bb1", "name": "ruddy-cosmic-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48958, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:53.350751+00:00", "ended_at": "2026-08-25T01:41:57.442279+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2a06d74f-d2f0-4065-9a3a-a15381033915", "name": "prickly-pristine-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49688, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:53.224253+00:00", "ended_at": "2026-08-25T01:41:56.996290+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2750eb50-c34c-46c9-b7d2-9a441de75dbc", "name": "wooded-tawny-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49674, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:39.521707+00:00", "ended_at": "2026-08-25T01:41:44.298638+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "973fd05e-d59a-4d9a-8669-c85956c42449", "name": "plucky-mossy-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34010, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:35.105498+00:00", "ended_at": "2026-08-25T01:41:41.106921+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "7e18a453-4b2a-46ff-a734-5ac4bedb511c", "name": "obsidian-granite-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60770, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:27.506919+00:00", "ended_at": "2026-08-25T01:41:32.905757+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a52d871a-f340-43da-88e7-c1ea01cae508", "name": "grumpy-courtly-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57002, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:16.411425+00:00", "ended_at": "2026-08-25T01:41:20.393047+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42321e67-3496-4fea-aad6-aeb6d376f363", "name": "bold-civil-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36924, "username": "erpnext", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:11.415864+00:00", "ended_at": "2026-08-25T01:41:17.104674+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "be5597ab-fd1d-4fc5-9ebe-34e93767086e", "name": "mossy-rugged-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35546, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:41:05.099828+00:00", "ended_at": "2026-08-25T01:41:10.208235+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30adc1fe-d8ab-4293-9900-a2f8b0a78e3f", "name": "jagged-dutiful-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36920, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:40:45.397313+00:00", "ended_at": "2026-08-25T01:40:50.805541+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4ea9332-ee13-4294-af11-68519747093c", "name": "somber-idle-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59004, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:40:36.802855+00:00", "ended_at": "2026-08-25T01:40:41.924501+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "588eec5b-3209-4c1f-b766-bbd4cd07fedb", "name": "graceful-ashen-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50770, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:40:30.505115+00:00", "ended_at": "2026-08-25T01:40:34.514541+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2bd5a9c-9061-4118-8ec6-cadc2dffc431", "name": "rugged-seaward-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59122, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:40:22.313928+00:00", "ended_at": "2026-08-25T01:40:27.097625+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7afa4d49-7cdb-4547-966e-014c84cc0165", "name": "leafy-thawing-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44030, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:40:22.197470+00:00", "ended_at": "2026-08-25T01:40:25.287932+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b440bf81-a91a-4f35-ab26-1333e4b3dacb", "name": "canny-wistful-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44008, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 183, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:40:04.094059+00:00", "ended_at": "2026-08-25T01:40:09.212737+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3cb7c2ff-3423-4495-a224-eb1aeb053de5", "name": "solar-fleeting-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37274, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:56.410503+00:00", "ended_at": "2026-08-25T01:40:01.313519+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b79dc30c-5125-464b-8759-7952e8dbdd21", "name": "mottled-foggy-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37894, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:53.698806+00:00", "ended_at": "2026-08-25T01:39:59.710888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a2a52788-9f02-4a25-b692-c9f34e7e6173", "name": "upland-dutiful-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48446, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:39.692540+00:00", "ended_at": "2026-08-25T01:39:44.534299+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "08be7824-4c2c-4471-8cc3-79a0c20fdd12", "name": "silent-thorny-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40738, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:33.102706+00:00", "ended_at": "2026-08-25T01:39:38.700638+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2b035c63-dc32-4662-b5eb-6f3aab7d98a3", "name": "snowy-windswept-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44940, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:29.999602+00:00", "ended_at": "2026-08-25T01:39:33.703348+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ffcee5e6-419d-4b26-b5c7-dcbe302ac3e3", "name": "tender-chilly-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44924, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:13.195086+00:00", "ended_at": "2026-08-25T01:39:18.309525+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b74325d-9713-4972-a09f-057e16375216", "name": "murky-nimble-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55678, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:39:09.418718+00:00", "ended_at": "2026-08-25T01:39:13.110053+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95af1543-d484-47a2-bea2-be0b9b752a77", "name": "nautical-alpine-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49164, "username": "test1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:52.410411+00:00", "ended_at": "2026-08-25T01:38:59.213498+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "05c2dc46-a065-4f63-869f-a4ec28cc6e06", "name": "jagged-rugged-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43612, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:52.002646+00:00", "ended_at": "2026-08-25T01:38:55.816851+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11e605ac-b881-4712-b2d4-e5a7b598b251", "name": "restless-bronzed-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47984, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:51.097553+00:00", "ended_at": "2026-08-25T01:38:56.901888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8ef4323d-7e65-4f24-a496-4fc9bc75140f", "name": "gilded-russet-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49190, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:47.996187+00:00", "ended_at": "2026-08-25T01:38:51.803719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff387eca-c1d0-45bf-b153-27b984fb4d5b", "name": "western-rustic-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44174, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:23.691765+00:00", "ended_at": "2026-08-25T01:38:26.723399+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a49b7d5a-7e96-4c94-9874-22ba55a10a02", "name": "amiable-ivory-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37788, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:23.498002+00:00", "ended_at": "2026-08-25T01:38:28.706375+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0876241-ce73-4d0c-bf68-d33304e20477", "name": "shaded-early-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42234, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:09.606005+00:00", "ended_at": "2026-08-25T01:38:15.315722+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7c349b88-9dd6-475c-93b3-cf8d11869652", "name": "whispering-upland-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43424, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:38:07.707197+00:00", "ended_at": "2026-08-25T01:38:15.408874+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "69fd1847-35a6-4a8f-9dc7-f05323bfe8a6", "name": "kindly-shaded-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41474, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:59.026937+00:00", "ended_at": "2026-08-25T01:38:02.117722+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b54cffdc-0a34-45ea-a1ed-63117db1532b", "name": "cobalt-dusty-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41460, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:47.208671+00:00", "ended_at": "2026-08-25T01:37:52.792401+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "795ef0c7-9f63-4a8c-a091-3409fd5271ee", "name": "barren-weathered-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44932, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:39.597290+00:00", "ended_at": "2026-08-25T01:37:42.819311+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86fa6d62-4fee-4bfe-abd9-e8f2df80c8e7", "name": "weathered-russet-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37778, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:32.404908+00:00", "ended_at": "2026-08-25T01:37:36.495965+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "14d80084-a762-4b7a-93dd-eaedf354cdc8", "name": "hazy-craggy-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35678, "username": "ghost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:31.195135+00:00", "ended_at": "2026-08-25T01:37:37.609829+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "caf9d667-2d91-4f0a-afce-0abe0c7537d1", "name": "subtle-loyal-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48508, "username": "aaa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:23.103341+00:00", "ended_at": "2026-08-25T01:37:30.931480+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d269a8bb-2070-4986-81f7-cf370a0a7863", "name": "reedy-mossy-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48772, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:37:04.397907+00:00", "ended_at": "2026-08-25T01:37:09.439082+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8632b709-ae6e-495e-89f2-4a65475fa48e", "name": "blazing-sullen-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48756, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:57.107662+00:00", "ended_at": "2026-08-25T01:37:00.524352+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "67a0a83a-2b84-4fba-82cd-96d5d656ae32", "name": "airy-meadow-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36062, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:51.005964+00:00", "ended_at": "2026-08-25T01:36:53.723064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ab349ab3-7098-4cd3-8742-6f78eb0ea29a", "name": "mighty-sleepy-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42288, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:49.410115+00:00", "ended_at": "2026-08-25T01:36:55.390883+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1999c25d-361a-4cec-8cc6-ab7f28b54f0a", "name": "mellow-marine-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33456, "username": "joel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:46.106907+00:00", "ended_at": "2026-08-25T01:36:53.508654+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "dc4819ee-f421-4f74-bb46-9f61fa770831", "name": "humble-mossy-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46088, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:22.293134+00:00", "ended_at": "2026-08-25T01:36:25.794965+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6dba1621-d701-482f-a796-247b81db02d8", "name": "creaky-daring-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60974, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 200, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:12.827386+00:00", "ended_at": "2026-08-25T01:36:17.904756+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5d16fff4-0f9d-4da9-b451-71e33424623e", "name": "bold-icy-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60988, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:10.106200+00:00", "ended_at": "2026-08-25T01:36:15.724660+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "66ffd293-b022-4bec-8d05-ef3ebf79e2b1", "name": "fleeting-sturdy-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55724, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:03.008117+00:00", "ended_at": "2026-08-25T01:36:08.509396+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "193bcc62-3283-45f5-a0cd-ac48085a8f75", "name": "languid-coral-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45062, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:36:01.110209+00:00", "ended_at": "2026-08-25T01:36:06.324526+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b764e865-ff46-462a-89a3-9d2941c005ab", "name": "hazel-vigilant-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35928, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:39.214188+00:00", "ended_at": "2026-08-25T01:35:43.531535+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b1ea6377-7461-461c-a532-63d23c034335", "name": "nameless-noble-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50126, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:35.406505+00:00", "ended_at": "2026-08-25T01:35:41.119943+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0fd43bd9-ffc6-4417-8c59-83d6c10350f0", "name": "whispering-sturdy-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42250, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:22.304226+00:00", "ended_at": "2026-08-25T01:35:26.526246+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a5bd32ca-f0a5-49a6-b8a4-76e97cf87a3c", "name": "nimble-quaint-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42244, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:21.412962+00:00", "ended_at": "2026-08-25T01:35:26.004752+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b09ef282-03b2-4429-a071-a8795cc3f963", "name": "curious-lanky-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44356, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:16.717881+00:00", "ended_at": "2026-08-25T01:35:19.506802+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85d9af6c-f9fa-4fb4-b192-441ae7a31876", "name": "dutiful-gentle-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47770, "username": "bot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:08.598200+00:00", "ended_at": "2026-08-25T01:35:16.916452+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "c93cb3a9-ba56-4840-9a25-0e9c20457f7c", "name": "fringed-cheerful-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56592, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:35:02.301320+00:00", "ended_at": "2026-08-25T01:35:08.127308+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6a636c63-7f63-4dcc-acdd-7b36a94763ba", "name": "crisp-fearless-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51434, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:49.694102+00:00", "ended_at": "2026-08-25T01:34:55.712369+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dc88e696-763c-424f-8827-acb87f8bf5a4", "name": "fleeting-solemn-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49372, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:42.717145+00:00", "ended_at": "2026-08-25T01:34:46.418016+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "87f9627d-f0c8-4624-abbd-c51b2b72d286", "name": "fearless-whispering-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49362, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:27.824654+00:00", "ended_at": "2026-08-25T01:34:31.907274+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8073a6eb-d90a-48d4-a35e-52f688e2851d", "name": "fierce-sunlit-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57340, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:19.407085+00:00", "ended_at": "2026-08-25T01:34:23.306060+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bfc63441-edde-4798-a4af-0843ffc719b0", "name": "courtly-dappled-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34900, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:15.188286+00:00", "ended_at": "2026-08-25T01:34:20.810845+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "52b834ad-dffd-4e0e-82c8-eec2140e21ad", "name": "placid-wooded-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34406, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:06.398841+00:00", "ended_at": "2026-08-25T01:34:09.297969+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd250c51-0820-49e0-b6e2-d5ffae321906", "name": "rapid-northern-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59324, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:34:03.260059+00:00", "ended_at": "2026-08-25T01:34:07.127676+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "237e273b-281f-4f45-b9f2-d5d0a0ce731d", "name": "misty-buoyant-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59300, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:33:51.299197+00:00", "ended_at": "2026-08-25T01:33:54.000885+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1af13093-93e9-4841-a72d-99a0db374b90", "name": "reedy-nautical-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54410, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:33:47.204704+00:00", "ended_at": "2026-08-25T01:33:52.304168+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a47529d5-7fb5-47f3-b0d6-8cee7bb13543", "name": "indigo-fabled-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40232, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:33:32.211097+00:00", "ended_at": "2026-08-25T01:33:35.304516+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f78344de-7adb-41e4-ad44-06348e3cb41b", "name": "civil-humble-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45366, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:33:22.305340+00:00", "ended_at": "2026-08-25T01:33:26.808106+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8f97483c-93b1-4f69-a2de-78b81b943615", "name": "grumpy-snowy-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57558, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:33:09.122346+00:00", "ended_at": "2026-08-25T01:33:12.435000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee698612-7403-486b-9be5-d8643b8a796f", "name": "earnest-candid-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57550, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:33:04.996235+00:00", "ended_at": "2026-08-25T01:33:07.912011+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d0982725-b7fa-4fc4-b100-92f2c9c15fe1", "name": "downy-lanky-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39076, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:59.699606+00:00", "ended_at": "2026-08-25T01:33:04.910190+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4e2de606-31ba-4ea7-bac8-acbee2576779", "name": "early-ashen-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36878, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:47.806248+00:00", "ended_at": "2026-08-25T01:32:53.617684+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4529d8dc-7be6-445a-838d-8b22fada72b7", "name": "fierce-salty-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55192, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 341, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:44.836732+00:00", "ended_at": "2026-08-25T01:32:47.715897+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "99713a94-2243-4769-a582-3655e3fbb151", "name": "gilded-peaty-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52602, "username": "amin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:35.050191+00:00", "ended_at": "2026-08-25T01:32:38.843138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6717b380-e275-49c2-b9c4-5e9cfb2b26ec", "name": "deft-wistful-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51914, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:23.801635+00:00", "ended_at": "2026-08-25T01:32:28.801239+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8abcac60-a447-4c7c-87b4-c3114f582c51", "name": "snowy-nimble-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51890, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:17.824497+00:00", "ended_at": "2026-08-25T01:32:21.908999+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09abf073-537e-43ed-bdeb-a451ec330696", "name": "chilly-honest-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54000, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:08.997111+00:00", "ended_at": "2026-08-25T01:32:12.508252+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "238ede7a-9f6d-4fbe-84f9-900fa9f79afa", "name": "coastal-prickly-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54688, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:32:02.007701+00:00", "ended_at": "2026-08-25T01:32:06.620492+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "064f552f-f44e-46dd-978c-02bf307719ef", "name": "lively-pristine-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54420, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:54.909543+00:00", "ended_at": "2026-08-25T01:32:01.899286+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c4ad6233-1d32-43f4-b72a-f3b43dd8bd71", "name": "diligent-gnarled-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37718, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:46.604937+00:00", "ended_at": "2026-08-25T01:31:52.217601+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "08029021-46db-47c7-8778-d2e50067140a", "name": "jovial-bitter-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40944, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:44.299065+00:00", "ended_at": "2026-08-25T01:31:48.294540+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06114c08-51b6-4d34-8051-2d19d83b861c", "name": "mellow-gilded-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55564, "username": "tester", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:28.804263+00:00", "ended_at": "2026-08-25T01:31:37.098623+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2ba3c06e-4740-46c7-8a46-a11aa05613b6", "name": "mindful-ancient-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37702, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:26.707127+00:00", "ended_at": "2026-08-25T01:31:29.386348+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12df1fe9-d52a-4572-a3f1-77ee23ecffa7", "name": "lucid-tangled-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39668, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:13.908502+00:00", "ended_at": "2026-08-25T01:31:18.106338+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "604067a9-ff2a-4c66-a174-e80ac47cd605", "name": "grassy-arctic-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57850, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:31:05.205615+00:00", "ended_at": "2026-08-25T01:31:09.891469+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db16826c-8f6a-422d-8821-543bb5d59953", "name": "knotted-verdant-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38826, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:52.795225+00:00", "ended_at": "2026-08-25T01:30:58.312340+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3f709c0d-679f-4e39-8b10-caac13b71f6a", "name": "drifting-humble-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56838, "username": "rancher", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:46.214229+00:00", "ended_at": "2026-08-25T01:30:52.695485+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "d7e15fa2-7598-420c-b1fd-475c2f19eecf", "name": "weathered-smooth-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:45.099393+00:00", "ended_at": "2026-08-25T01:30:49.132176+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d8a7c670-158a-4ddc-8838-241d2d1cf16f", "name": "vigilant-frugal-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53050, "username": "service", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:33.805804+00:00", "ended_at": "2026-08-25T01:30:41.815801+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "221785b6-5f23-4f4e-ae04-43f3c468957d", "name": "blunt-austere-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51826, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:18.516053+00:00", "ended_at": "2026-08-25T01:30:21.308814+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c9b9bbf6-b866-466f-bc64-be525aa5d813", "name": "vigilant-ancient-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36366, "username": "oscar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:05.304415+00:00", "ended_at": "2026-08-25T01:30:11.298042+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "1eb99ccc-f663-4aff-abc2-c35964013b30", "name": "watchful-tangled-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56474, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:04.787503+00:00", "ended_at": "2026-08-25T01:30:10.400147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e2855ce-3e02-47a8-9384-6fd04979291a", "name": "rambling-grassy-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52136, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:30:02.916944+00:00", "ended_at": "2026-08-25T01:30:06.211788+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04a76608-e783-49e0-8052-c4a18d48afa3", "name": "glacial-coastal-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36364, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:56.602785+00:00", "ended_at": "2026-08-25T01:30:03.087329+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "769db5ac-fc46-4ed7-8cae-cf47eebf416b", "name": "rapid-flinty-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54132, "username": "main", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 340, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:41.615160+00:00", "ended_at": "2026-08-25T01:29:48.516437+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "b193a110-bc81-48c0-86e6-e7c076c88e03", "name": "rustic-flinty-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47476, "username": "a", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:40.103341+00:00", "ended_at": "2026-08-25T01:29:44.117758+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c8bc2bb-5121-479b-ad13-d0ab4a0c7de7", "name": "wistful-ivory-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40266, "username": "kelly", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:30.912467+00:00", "ended_at": "2026-08-25T01:29:38.911373+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "9552104a-32b8-4f17-9602-b8569fc84ef4", "name": "mossy-golden-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50270, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:15.814156+00:00", "ended_at": "2026-08-25T01:29:21.518671+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0c30a41a-1848-4db1-a064-3c3fe4de4512", "name": "spirited-hollow-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49266, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:03.510485+00:00", "ended_at": "2026-08-25T01:29:10.890648+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "1f61ae81-59ea-4d90-be39-7e9819a712ac", "name": "painted-leafy-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40260, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:29:01.301616+00:00", "ended_at": "2026-08-25T01:29:03.988021+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a04e56b-054a-4993-a1cc-13685e39351d", "name": "lucid-frugal-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40250, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:57.421466+00:00", "ended_at": "2026-08-25T01:29:00.299324+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3a719ea-a51f-4ee1-92a7-b5fcb2f104cb", "name": "verdant-tangled-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59924, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:49.914105+00:00", "ended_at": "2026-08-25T01:28:55.712330+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1bf90aeb-6657-486c-a55b-70d5440ae8d5", "name": "upland-nameless-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52366, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:44.903343+00:00", "ended_at": "2026-08-25T01:28:49.998803+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "b540d4aa-6cb0-4eb7-a812-05093649fa95", "name": "forlorn-austere-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46952, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:19.202436+00:00", "ended_at": "2026-08-25T01:28:25.114837+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c9bc234a-ea9d-4dc6-b9fc-fceecbb1fe05", "name": "ashen-watchful-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34902, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:15.215719+00:00", "ended_at": "2026-08-25T01:28:18.304398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45f9023c-cf30-4858-81a8-2353fd8cb1cb", "name": "cobalt-watchful-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34888, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:13.622479+00:00", "ended_at": "2026-08-25T01:28:18.306676+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "34c80aac-d880-4ad4-8a92-36aab97b2a58", "name": "painted-western-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45362, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:28:00.315384+00:00", "ended_at": "2026-08-25T01:28:07.108514+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d2d27fa1-cf39-4e6f-adea-103c4c6965b5", "name": "painted-feral-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40336, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:58.497931+00:00", "ended_at": "2026-08-25T01:28:01.703797+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7c022732-c237-493e-be32-e096b56d5c79", "name": "hazel-pleasant-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46028, "username": "christianna", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:47.714278+00:00", "ended_at": "2026-08-25T01:27:55.021664+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1664 }, { "id": "5a488507-247d-4848-9e20-f28af34ff69a", "name": "salty-dusky-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38866, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:29.710707+00:00", "ended_at": "2026-08-25T01:27:33.107293+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f68c0ec-9397-4cb8-83cf-6d86b3fe9940", "name": "chilly-feral-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53166, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:24.323826+00:00", "ended_at": "2026-08-25T01:27:27.018364+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dfb36b7d-a568-4cf5-9f57-264330a61b42", "name": "pristine-steady-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53150, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:20.215206+00:00", "ended_at": "2026-08-25T01:27:24.789737+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b33b3dc8-bbda-4343-926a-7230f94cfe39", "name": "lively-canny-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59088, "username": "edge", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:15.504827+00:00", "ended_at": "2026-08-25T01:27:23.717860+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "25ff8475-159d-4188-acfd-a0295f11e34e", "name": "civil-rambling-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60904, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:27:02.004165+00:00", "ended_at": "2026-08-25T01:27:06.636727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff7b3af8-e287-4c12-b428-8ba98daf99bd", "name": "pleasant-canny-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40610, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:54.916591+00:00", "ended_at": "2026-08-25T01:26:58.628338+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f7cd8ec3-26cf-4440-b390-195cdd40318e", "name": "golden-gritty-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47616, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:51.722066+00:00", "ended_at": "2026-08-25T01:26:56.835956+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8466daf-e1bd-4883-b14b-4af7eaa9ecb3", "name": "quartz-civil-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34122, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:37.121069+00:00", "ended_at": "2026-08-25T01:26:42.507011+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8b1788e2-a6a1-47ed-af6e-9472777d518b", "name": "lively-cobalt-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34108, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:20.600958+00:00", "ended_at": "2026-08-25T01:26:24.121459+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "20ad488f-57f7-4a32-8911-131bd2626fbe", "name": "boreal-ancient-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50086, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:18.513478+00:00", "ended_at": "2026-08-25T01:26:23.901549+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "02453f48-9b0f-40e2-91d3-901df9204aa4", "name": "pleasant-dusky-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43538, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:07.126541+00:00", "ended_at": "2026-08-25T01:26:12.604038+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f43a213f-b94a-4b72-8595-934d58e5e521", "name": "obsidian-arctic-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53558, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:26:01.013760+00:00", "ended_at": "2026-08-25T01:26:06.409039+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "15e641ad-eaa1-40d4-8870-8a3b8aac5758", "name": "lively-sleepy-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36662, "username": "osmc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:59.212952+00:00", "ended_at": "2026-08-25T01:26:07.719522+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "8fe442af-2626-45ee-b710-1fe107c00a2d", "name": "blithe-misty-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50384, "username": "onkar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:43.408467+00:00", "ended_at": "2026-08-25T01:25:51.202827+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "41814cee-9a4e-4926-913a-cbe8e4e89d0b", "name": "oaken-jagged-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50380, "username": "admin123", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:38.802424+00:00", "ended_at": "2026-08-25T01:25:46.595538+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ca586711-31d2-4985-8f4e-c81e5c4b72dd", "name": "nameless-hazy-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60032, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:38.298273+00:00", "ended_at": "2026-08-25T01:25:42.003203+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ba3909ad-7d86-4611-8458-c4ba13c463f8", "name": "opal-reedy-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56810, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:22.297163+00:00", "ended_at": "2026-08-25T01:25:27.623224+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac3a639a-eb67-44b3-82b9-bd974d8526fb", "name": "knotted-ginger-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37198, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:16.505236+00:00", "ended_at": "2026-08-25T01:25:20.114146+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e4657e1-3755-4753-a338-ec5653d3ae15", "name": "cosmic-spirited-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59938, "username": "hummingbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:13.211536+00:00", "ended_at": "2026-08-25T01:25:20.726447+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "c7aa94b0-6c08-4ebe-95be-7631a158fec2", "name": "proud-tidal-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35524, "username": "amine", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:25:05.330700+00:00", "ended_at": "2026-08-25T01:25:13.004993+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "30959eff-2c35-4df7-bbb8-bb23622d3b8e", "name": "mighty-northern-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46520, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:24:49.042837+00:00", "ended_at": "2026-08-25T01:24:54.818720+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd2712bd-4801-4624-9fa4-2ee61c8c4047", "name": "leafy-mighty-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37678, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:24:34.993466+00:00", "ended_at": "2026-08-25T01:24:40.901855+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "064ff918-f29f-4705-8002-bfb61245f9eb", "name": "brazen-whispering-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37664, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:24:26.509799+00:00", "ended_at": "2026-08-25T01:24:30.216379+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dba885c1-30e3-4c9f-8bb5-b1c887d94508", "name": "glassy-sincere-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46930, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:24:20.498397+00:00", "ended_at": "2026-08-25T01:24:25.314116+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11649587-d816-42d5-a884-f78c66f028ee", "name": "wiry-autumn-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58450, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:24:10.400380+00:00", "ended_at": "2026-08-25T01:24:14.509398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "546932d4-53f8-44c1-aaa1-4a40bbe0c7a2", "name": "rustic-rapid-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51634, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:24:05.311580+00:00", "ended_at": "2026-08-25T01:24:10.915540+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "704f11ee-ae7c-4a38-86bf-b670bddadd45", "name": "sturdy-civil-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43500, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:56.718471+00:00", "ended_at": "2026-08-25T01:24:02.037789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "72385f48-dd2b-4df0-91ad-708673a79533", "name": "nautical-twilight-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36124, "username": "init", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:38.416831+00:00", "ended_at": "2026-08-25T01:23:46.601907+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4efd0513-e3e8-4fa9-8d3b-f41566bcc2dd", "name": "patient-brisk-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37702, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:38.109757+00:00", "ended_at": "2026-08-25T01:23:40.896674+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45f96e3e-571b-4407-b3c3-d0d424d1719c", "name": "upland-plucky-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37674, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:37.319728+00:00", "ended_at": "2026-08-25T01:23:40.206605+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d333132b-29ba-4418-bd7f-a2305bfbd928", "name": "opal-lively-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57420, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:19.231302+00:00", "ended_at": "2026-08-25T01:23:23.098844+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ef2b926d-8b02-41dd-8514-42a27c8fb618", "name": "downy-bold-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34518, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:15.509502+00:00", "ended_at": "2026-08-25T01:23:21.503164+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b20fd53-136e-4e37-b4fd-810817a9533a", "name": "craggy-hardy-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49048, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:05.299031+00:00", "ended_at": "2026-08-25T01:23:10.118492+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "13c7cafe-9ec6-4b5f-bfd4-07d7cb1409d7", "name": "hushed-windswept-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49040, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:23:04.605281+00:00", "ended_at": "2026-08-25T01:23:11.614050+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "70294f6b-6ee4-4077-aa44-2f28fa75208a", "name": "pristine-windswept-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53304, "username": "playground", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:51.919748+00:00", "ended_at": "2026-08-25T01:22:57.703278+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "b4ccd5b0-f60e-4a10-83dd-84b990c2c58e", "name": "wry-glacial-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41274, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:48.793741+00:00", "ended_at": "2026-08-25T01:22:54.505308+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a2cca1da-18ba-45a7-9b7c-7420675c042e", "name": "hushed-inland-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33072, "username": "reza", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:39.208964+00:00", "ended_at": "2026-08-25T01:22:46.099748+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4239cb93-3b33-46fc-926c-ec2c2cd2265e", "name": "northern-honest-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44562, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:36.911660+00:00", "ended_at": "2026-08-25T01:22:40.704049+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2d2ac88-5b25-4c8d-b6f6-dccf05fa216a", "name": "mighty-peaty-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33060, "username": "hduser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:23.014606+00:00", "ended_at": "2026-08-25T01:22:29.005826+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6a0f9b95-46a7-45df-baf3-a3672e3b8805", "name": "fleeting-restless-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38114, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 276, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:18.413039+00:00", "ended_at": "2026-08-25T01:22:23.703192+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "4729c420-b21a-44f1-bc5b-b1f063dc26c7", "name": "feral-misty-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33488, "username": "fahmi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:22:12.105170+00:00", "ended_at": "2026-08-25T01:22:18.114371+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "83508947-b5c7-4397-8171-38e3e46b505c", "name": "sunlit-windswept-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35916, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:52.631774+00:00", "ended_at": "2026-08-25T01:21:56.129630+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "158eab51-53d7-416d-8d03-4ab003cf2def", "name": "plucky-ancient-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52214, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 227, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:43.214763+00:00", "ended_at": "2026-08-25T01:21:46.704289+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "581af47d-96b1-4a60-9002-8106b624ae8c", "name": "smooth-knotted-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52172, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:38.512250+00:00", "ended_at": "2026-08-25T01:21:43.428052+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7ec10de3-cb78-4203-9746-1cfab2c5cd20", "name": "forlorn-rugged-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55048, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:36.705044+00:00", "ended_at": "2026-08-25T01:21:43.704059+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "b7c19602-32ba-460e-b503-3a201258765c", "name": "wiry-icy-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48206, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:30.108246+00:00", "ended_at": "2026-08-25T01:21:34.704118+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aafedf49-7b60-45ab-8eca-bae1aeb1f143", "name": "fleeting-hidden-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50710, "username": "jay", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 207, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:18.699749+00:00", "ended_at": "2026-08-25T01:21:26.803488+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "1402bad8-196f-4ba6-b1f9-928af4312c07", "name": "idle-hazel-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50694, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:11.707891+00:00", "ended_at": "2026-08-25T01:21:14.612524+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b73db03-d5e9-400e-853a-0872a0dfbc8a", "name": "blunt-plucky-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50444, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:21:02.599773+00:00", "ended_at": "2026-08-25T01:21:07.409033+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3098d63-98ff-41a3-9de9-48004ee10bb7", "name": "cunning-painted-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46504, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:59.311182+00:00", "ended_at": "2026-08-25T01:21:04.721957+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a5b407f3-2047-4e2b-b2b5-c2d22d2cbc49", "name": "ivory-smooth-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46478, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:47.002836+00:00", "ended_at": "2026-08-25T01:20:50.730122+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "35fb2eef-8975-45d8-8cd2-3377a92b3ee8", "name": "prickly-brave-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45140, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:35.408408+00:00", "ended_at": "2026-08-25T01:20:40.412651+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "548d41cf-5446-484c-b6db-66efcfda528e", "name": "solemn-somber-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54908, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:35.002457+00:00", "ended_at": "2026-08-25T01:20:39.101516+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e907fb62-c028-422f-b152-8bb1e6d62953", "name": "calm-solar-crossbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52562, "username": "grid", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:31.290171+00:00", "ended_at": "2026-08-25T01:20:37.502480+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "8394b514-5167-4b93-97be-c515896d0d00", "name": "lofty-vivid-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52552, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:23.702724+00:00", "ended_at": "2026-08-25T01:20:31.293098+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "e4b7c99b-afde-4c67-8403-d19d19463ef2", "name": "noble-meadow-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56492, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:15.500025+00:00", "ended_at": "2026-08-25T01:20:18.315500+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "840d0bfb-8c38-4ce6-bbc9-eba0303b0654", "name": "wry-tangled-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48720, "username": "nutanix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:07.316873+00:00", "ended_at": "2026-08-25T01:20:14.700081+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "d66217da-9611-4864-a3b6-778f5e916618", "name": "orderly-zealous-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44088, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:20:04.108885+00:00", "ended_at": "2026-08-25T01:20:11.107054+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "435963ea-8326-4cd3-8002-72b0b89ad0cc", "name": "fabled-obsidian-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44068, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:57.806523+00:00", "ended_at": "2026-08-25T01:20:05.827921+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "be1d4336-feae-401b-9517-8b429559ed87", "name": "whispering-lanky-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59116, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:49.904851+00:00", "ended_at": "2026-08-25T01:19:54.886719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8754ab9e-b7e5-40d1-81ee-621c463e3548", "name": "fringed-orderly-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48262, "username": "agent", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:35.807704+00:00", "ended_at": "2026-08-25T01:19:40.598784+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "67f6d89f-8889-4832-af19-88a2d7c7249f", "name": "gritty-mindful-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48238, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:27.596062+00:00", "ended_at": "2026-08-25T01:19:32.292895+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed812216-35e2-491d-938e-cf1e1d5974a8", "name": "hollow-feathered-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47436, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:16.110604+00:00", "ended_at": "2026-08-25T01:19:19.909253+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12479431-0741-49cf-9984-923bbdd0cfee", "name": "buoyant-courtly-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39164, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:16.011732+00:00", "ended_at": "2026-08-25T01:19:20.608473+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2b169a08-0ebe-4c47-a712-40c50a14b7ca", "name": "dappled-twilight-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35612, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:19:05.805213+00:00", "ended_at": "2026-08-25T01:19:10.809014+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b6e955f9-5266-4f66-a4a0-09490691611b", "name": "subtle-verdant-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51912, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:56.190818+00:00", "ended_at": "2026-08-25T01:19:02.101826+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d1ba8dda-c684-45ef-b101-ddb4542ae083", "name": "dappled-umber-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35604, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:53.905728+00:00", "ended_at": "2026-08-25T01:18:58.223064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b77ad8b-1d1d-49e3-be50-d710081018c4", "name": "glassy-lonesome-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49712, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:41.402391+00:00", "ended_at": "2026-08-25T01:18:47.198305+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "99a95bf9-7817-487c-9ed1-6712bf543c97", "name": "valiant-lofty-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49720, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:38.707534+00:00", "ended_at": "2026-08-25T01:18:43.317523+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f124a15-6743-4519-a389-fc6fe0ae92cc", "name": "murky-sleepy-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43356, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:31.020287+00:00", "ended_at": "2026-08-25T01:18:34.699338+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4686e070-0f96-4cba-8040-122080f00636", "name": "keen-mottled-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38612, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:22.901811+00:00", "ended_at": "2026-08-25T01:18:31.022278+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "e47187aa-adf7-4c17-b5e4-21288a0ce53d", "name": "cobalt-tidal-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53872, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:22.607727+00:00", "ended_at": "2026-08-25T01:18:26.218795+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7dfcf600-b460-48d7-a0c4-36dabfe554e3", "name": "plucky-bashful-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38594, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:11.720018+00:00", "ended_at": "2026-08-25T01:18:14.603101+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8842157a-7de6-4845-9b20-865ad1e7c0cc", "name": "fabled-tranquil-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38570, "username": "niaoyun", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:18:03.211921+00:00", "ended_at": "2026-08-25T01:18:08.512094+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "09ba1cb8-77df-46bf-a144-56f8172163a1", "name": "proud-granite-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:57.302998+00:00", "ended_at": "2026-08-25T01:18:01.611989+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e1149851-4446-4d8a-b76f-98dcbc4f9817", "name": "calm-wooded-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41104, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:47.900054+00:00", "ended_at": "2026-08-25T01:17:53.993052+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92b529d2-96e1-48fb-811d-53e6b8895c3b", "name": "prickly-regal-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41092, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:36.106075+00:00", "ended_at": "2026-08-25T01:17:40.889997+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7b08021-a2b2-4d6f-93c1-e494b7013b5f", "name": "fabled-calm-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41352, "username": "zahra", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:32.810664+00:00", "ended_at": "2026-08-25T01:17:40.805001+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "acfe747e-2a1b-402c-a094-18d2afe451c9", "name": "inland-wandering-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36298, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:27.099965+00:00", "ended_at": "2026-08-25T01:17:33.115451+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b8b07b6c-678e-49f6-a886-f7e1cdff230f", "name": "rambling-fierce-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54128, "username": "codex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:20.308901+00:00", "ended_at": "2026-08-25T01:17:25.405636+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "d5a3ac03-c424-4e47-82ea-8661c1583e94", "name": "calm-velvet-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54104, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:08.304896+00:00", "ended_at": "2026-08-25T01:17:11.691392+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2e8df907-ee05-4d0f-9049-682016b22162", "name": "tidal-russet-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51070, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:17:01.101528+00:00", "ended_at": "2026-08-25T01:17:05.394244+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "796965cc-63b4-48a2-b77d-3353e3a5f486", "name": "cheerful-hidden-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43230, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:58.416173+00:00", "ended_at": "2026-08-25T01:17:06.301704+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9e511e49-7d94-4e38-a89d-98e9912ccf02", "name": "vivid-plucky-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43006, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:41.006332+00:00", "ended_at": "2026-08-25T01:16:46.307906+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4903e2e-a08a-43e6-8011-1f1115de9f3e", "name": "upland-restless-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38302, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:37.508819+00:00", "ended_at": "2026-08-25T01:16:40.899123+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ff3b6809-b91c-410c-9571-98adc23de8f5", "name": "icy-prairie-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38292, "username": "odoo16", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:28.209588+00:00", "ended_at": "2026-08-25T01:16:36.509155+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "486fd07f-5e97-4694-b2c8-ba545b96208f", "name": "forlorn-spirited-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59256, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:27.003136+00:00", "ended_at": "2026-08-25T01:16:30.304939+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28046a48-d094-4b2a-a18c-9a5f83192fd4", "name": "somber-northern-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55140, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:11.604953+00:00", "ended_at": "2026-08-25T01:16:20.123398+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "9cd74ab5-3595-4803-8e69-d3078b3ddeae", "name": "tranquil-hollow-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32938, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:16:07.592237+00:00", "ended_at": "2026-08-25T01:16:12.401044+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c1174738-15c3-480e-af77-8ccc9ab67f81", "name": "silent-velvet-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42910, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:58.216216+00:00", "ended_at": "2026-08-25T01:16:04.100355+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ce42f1fc-ebe4-4729-8c0d-044903c3713e", "name": "dewy-vigilant-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50696, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:46.308476+00:00", "ended_at": "2026-08-25T01:15:49.220740+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30bc1f4d-f840-483f-92c7-0e7f02ffbf14", "name": "frugal-vigilant-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36814, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:34.808445+00:00", "ended_at": "2026-08-25T01:15:39.804041+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "595aadbe-afc8-4bc5-9787-5e264038e637", "name": "smoky-deft-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47512, "username": "sol", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:26.810294+00:00", "ended_at": "2026-08-25T01:15:33.992159+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "429e544c-9b87-46eb-8920-a4ed2f4613ff", "name": "cunning-sleepy-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36798, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:23.611069+00:00", "ended_at": "2026-08-25T01:15:28.301332+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b8f1d525-6d52-4f39-8ea8-a2df99f3f001", "name": "sunlit-umber-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40534, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:13.208571+00:00", "ended_at": "2026-08-25T01:15:17.587795+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "984dbf0e-a373-495e-ba7a-044532485aa2", "name": "fickle-creaky-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49474, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:04.662098+00:00", "ended_at": "2026-08-25T01:15:08.047145+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ca86321-1511-44aa-8aaa-bc69e396f1ae", "name": "amber-whispering-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48390, "username": "devuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:15:01.806706+00:00", "ended_at": "2026-08-25T01:15:07.219570+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "960ee1e4-bc07-4039-8afe-d9c3125fab41", "name": "genial-solar-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46570, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:14:45.810500+00:00", "ended_at": "2026-08-25T01:14:53.105893+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "e8828e41-9328-42f8-b557-7ff8224435ac", "name": "coral-tranquil-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46572, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:14:41.409728+00:00", "ended_at": "2026-08-25T01:14:46.019355+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0727b19a-9f6c-4150-b18f-f70260f0dc33", "name": "feathered-windswept-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57928, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:14:26.999897+00:00", "ended_at": "2026-08-25T01:14:30.513577+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d91f8712-2a56-4132-829e-f00879d00ba6", "name": "arctic-hazy-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58946, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:14:19.606282+00:00", "ended_at": "2026-08-25T01:14:24.111648+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "caac8381-9798-43a2-b5f1-9f7db29aa753", "name": "upland-jovial-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51792, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:14:13.311448+00:00", "ended_at": "2026-08-25T01:14:18.413359+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "190527ee-871c-4b29-beed-4eb5fbdbd8a4", "name": "flinty-solar-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51186, "username": "user3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:14:06.012389+00:00", "ended_at": "2026-08-25T01:14:12.897812+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "b3c9e6c3-dc00-45b4-9625-48099a6bdcad", "name": "thawing-tranquil-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57020, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:59.408852+00:00", "ended_at": "2026-08-25T01:14:02.396213+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b5c16bb3-36fa-46ed-95ea-41e3ead61479", "name": "misty-sterling-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51168, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:43.105581+00:00", "ended_at": "2026-08-25T01:13:46.516082+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d3075879-b261-4873-9c5f-9791ecd79372", "name": "obsidian-sunlit-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56798, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:37.907570+00:00", "ended_at": "2026-08-25T01:13:42.808523+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ed5f08f0-8931-4a50-bcc3-68196660537c", "name": "shifting-feral-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52226, "username": "default", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:27.719914+00:00", "ended_at": "2026-08-25T01:13:33.898986+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "96c67601-c409-44a5-b281-b11de0d873da", "name": "glassy-loyal-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40744, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:23.000429+00:00", "ended_at": "2026-08-25T01:13:28.246301+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5653d479-dab4-42f7-a1c9-ebe7f5923bb2", "name": "fringed-snowy-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58104, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:10.520280+00:00", "ended_at": "2026-08-25T01:13:14.412581+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e0ace45-6a7f-450a-b116-061cdfaa3c9f", "name": "sleepy-lawful-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34802, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:08.298967+00:00", "ended_at": "2026-08-25T01:13:13.815248+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "936e14fe-774d-4267-99d2-28b4bee4ea27", "name": "sincere-ancient-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48908, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:02.703489+00:00", "ended_at": "2026-08-25T01:13:10.492163+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "3b1146ed-5e7e-4717-a75d-5aae1bd19362", "name": "stoic-gleaming-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34758, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:13:02.095633+00:00", "ended_at": "2026-08-25T01:13:05.588301+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "409c2330-3987-48ac-9d90-b10110987b3d", "name": "vernal-placid-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51500, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:41.005550+00:00", "ended_at": "2026-08-25T01:12:46.106016+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "589a0d51-92b5-4054-a275-323796ccda6e", "name": "golden-spirited-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50758, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:35.506297+00:00", "ended_at": "2026-08-25T01:12:41.313161+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5a979e23-e6c3-4bf8-8c9e-4cdaedc168aa", "name": "prairie-flinty-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40276, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 353, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:25.022545+00:00", "ended_at": "2026-08-25T01:12:28.010871+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b7119fe4-b355-4ead-ad7e-18e7d54001ab", "name": "smoky-mighty-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40252, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:17.038151+00:00", "ended_at": "2026-08-25T01:12:21.319883+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4eb4f717-c859-44b7-9587-c579878a7233", "name": "sunlit-western-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41856, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:11.205673+00:00", "ended_at": "2026-08-25T01:12:15.528124+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "29d418f5-36dc-4df4-8914-28377f20410c", "name": "stoic-restless-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47086, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:02.932528+00:00", "ended_at": "2026-08-25T01:12:10.226676+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "06ef76e3-0ba9-4ed9-81ad-62bed3bdacfa", "name": "early-downy-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36236, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:12:00.303820+00:00", "ended_at": "2026-08-25T01:12:06.004036+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e91484c5-1933-417d-9812-04f558f82eb1", "name": "sterling-vigilant-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47376, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:11:49.811407+00:00", "ended_at": "2026-08-25T01:11:52.609936+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09735a95-b257-4a0c-aa24-3ef706980330", "name": "crimson-bitter-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39466, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:11:36.403006+00:00", "ended_at": "2026-08-25T01:11:40.332592+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b07244be-1f38-4750-a247-6b9a6e3d2a6d", "name": "sooty-frugal-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39432, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:11:27.111936+00:00", "ended_at": "2026-08-25T01:11:32.804006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ad271ab1-bdc8-4b64-b4b1-dc536b864c8b", "name": "balmy-opal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46838, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:11:22.808021+00:00", "ended_at": "2026-08-25T01:11:25.706709+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7726900b-4e7b-4f5e-91d8-fd2d629e5721", "name": "steady-clever-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58772, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:11:14.802592+00:00", "ended_at": "2026-08-25T01:11:19.997716+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8686b763-afd0-4a08-a64c-6fbe2a7d075d", "name": "cosmic-prairie-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45156, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:11:14.418723+00:00", "ended_at": "2026-08-25T01:11:19.905263+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "9fd9590c-c213-4add-86cb-f7763237d72e", "name": "painted-gritty-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53858, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:57.804272+00:00", "ended_at": "2026-08-25T01:11:03.711483+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "973ec378-ab84-4837-aba4-89d449cb4e31", "name": "muted-electric-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43498, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:49.615471+00:00", "ended_at": "2026-08-25T01:10:56.430454+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7941781a-ca1b-4108-9fcf-4cb8190171ab", "name": "tawny-jagged-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43484, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:36.008889+00:00", "ended_at": "2026-08-25T01:10:40.622923+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "592e6562-26f3-46ad-aed3-4cb65a017a8c", "name": "humble-feathered-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49688, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:30.827072+00:00", "ended_at": "2026-08-25T01:10:34.221837+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fe295860-a1c2-4ae0-bd86-6874cd30585a", "name": "solar-pleasant-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42588, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:25.407065+00:00", "ended_at": "2026-08-25T01:10:29.123874+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "415dcfa5-f4ec-453c-9bd7-782caffbdae9", "name": "orderly-sincere-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47856, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:19.722800+00:00", "ended_at": "2026-08-25T01:10:24.708208+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "7eac1b92-afe7-4d8c-9293-29f270a9fe56", "name": "spirited-pristine-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57644, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:10:08.658291+00:00", "ended_at": "2026-08-25T01:10:14.031012+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7209c5e0-2a12-4a7e-b334-c38efc34b22e", "name": "tidal-drifting-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47842, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:54.708258+00:00", "ended_at": "2026-08-25T01:10:00.608558+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7cc71d9-00e3-4952-b52f-5f17b8d34e85", "name": "noble-balmy-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35110, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:51.006363+00:00", "ended_at": "2026-08-25T01:09:54.422017+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bc7f13dc-b22a-4a69-8b7d-b5678e1e7809", "name": "tranquil-mighty-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58206, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:40.658403+00:00", "ended_at": "2026-08-25T01:09:45.052693+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3bb9bffa-b9cd-4c89-bf13-d20615c6d37d", "name": "proud-smooth-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45686, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:37.520006+00:00", "ended_at": "2026-08-25T01:09:41.087891+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c6c571b3-7de5-4513-ba05-fe0fdf7a4e70", "name": "burly-serene-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39866, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:26.420027+00:00", "ended_at": "2026-08-25T01:09:30.819848+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "052cf452-02ec-4f15-aec8-f16ebf02589c", "name": "dutiful-thorny-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42978, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:15.612414+00:00", "ended_at": "2026-08-25T01:09:18.727064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70d45218-2203-4866-afa2-89c01d3f45e5", "name": "coastal-craggy-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42956, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:07.109181+00:00", "ended_at": "2026-08-25T01:09:12.105124+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1b8fcc58-d683-43b1-bb99-00da5afa46c6", "name": "vigilant-solar-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54668, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:01.419182+00:00", "ended_at": "2026-08-25T01:09:06.512276+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0b55c3ab-72bd-4735-882a-51b645486da4", "name": "solar-gallant-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32934, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:09:01.021433+00:00", "ended_at": "2026-08-25T01:09:07.952704+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1672 }, { "id": "78b688d3-6a16-4f16-987f-e33859fc7287", "name": "frank-electric-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50080, "username": "cursor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:08:45.511387+00:00", "ended_at": "2026-08-25T01:08:51.104149+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a51a2da1-94d6-4ad5-8db8-5f511f353217", "name": "noble-austere-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46862, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:08:33.445275+00:00", "ended_at": "2026-08-25T01:08:38.043491+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c8804291-19fb-4a99-97d4-75cad156d80b", "name": "pleasant-proud-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55824, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:08:23.121675+00:00", "ended_at": "2026-08-25T01:08:28.118490+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41461d67-8a4c-4381-8ec3-e0f382f678f2", "name": "wandering-fearless-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35288, "username": "node", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:08:19.310895+00:00", "ended_at": "2026-08-25T01:08:27.402225+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "9789a20b-29b8-4020-89ef-94cdc201542e", "name": "painted-proud-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55822, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:08:17.116046+00:00", "ended_at": "2026-08-25T01:08:22.634560+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "67ef40e5-d209-4180-b69a-43dc2ffb609c", "name": "seaward-craggy-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58508, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:08:02.711729+00:00", "ended_at": "2026-08-25T01:08:07.298478+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eeeacb10-6958-4289-a3cc-c54ed3e28caa", "name": "tender-wooded-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35870, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:52.711169+00:00", "ended_at": "2026-08-25T01:07:58.415020+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1d38908f-e851-45e7-8fe2-a83dbd7977b6", "name": "valiant-inland-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54238, "username": "packer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:52.505911+00:00", "ended_at": "2026-08-25T01:07:57.913635+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "556ff795-5b74-4df6-a4f9-7044f25fb51a", "name": "breezy-hazy-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43434, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:38.212110+00:00", "ended_at": "2026-08-25T01:07:45.108066+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1349bc8d-27eb-4d48-b5e4-ba5f738016a2", "name": "subtle-inland-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43422, "username": "daniel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:35.505227+00:00", "ended_at": "2026-08-25T01:07:41.999156+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9000d00d-325e-425a-815a-0c5422ed4332", "name": "leafy-distant-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46342, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:22.603833+00:00", "ended_at": "2026-08-25T01:07:25.813010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80af752c-d480-4c35-9feb-3224d557e6a7", "name": "brazen-ashen-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48972, "username": "www", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:11.204246+00:00", "ended_at": "2026-08-25T01:07:18.992845+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "2255ad64-b35c-4563-a100-510d49b4d45d", "name": "hollow-upland-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40318, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:07:09.005587+00:00", "ended_at": "2026-08-25T01:07:13.203608+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd64e188-562d-4922-971a-2d1a74c06ee0", "name": "tidal-frosty-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59652, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:48.787994+00:00", "ended_at": "2026-08-25T01:06:52.620673+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bb23f1d7-6945-4ae2-8a64-dfeb4ea9ce65", "name": "plucky-chilly-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37426, "username": "vyos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:48.405632+00:00", "ended_at": "2026-08-25T01:06:55.513817+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3ba23f0f-653f-454b-863e-f5eac761f706", "name": "nameless-downy-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47328, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:41.512784+00:00", "ended_at": "2026-08-25T01:06:50.106847+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "0774060a-b367-4f5a-82e1-11b318f054c4", "name": "cheerful-fabled-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37410, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:39.697047+00:00", "ended_at": "2026-08-25T01:06:44.406475+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eff1ab11-cf37-4ce5-9b4a-e71815c75191", "name": "gloomy-shaded-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42826, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:23.499945+00:00", "ended_at": "2026-08-25T01:06:29.596785+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51a3a2da-3c0b-453f-90da-95e4b7cc78e5", "name": "slender-downy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54266, "username": "ranga", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:23.028948+00:00", "ended_at": "2026-08-25T01:06:29.324603+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "bee2869f-16c4-40ed-ab34-60261ef51343", "name": "wistful-hearty-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43940, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:06:03.696921+00:00", "ended_at": "2026-08-25T01:06:08.307011+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8623e031-e6c5-4a45-9d17-11fa84dcf96a", "name": "windswept-lawful-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39266, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 362, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:59.003575+00:00", "ended_at": "2026-08-25T01:06:04.026874+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dbc1e5a6-bbb6-42b8-9a23-2d76208346c8", "name": "wistful-russet-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40512, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:54.614149+00:00", "ended_at": "2026-08-25T01:06:02.621591+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "54fe77c3-8aaf-4ecb-8b54-4ea29e4f712b", "name": "ginger-mossy-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39250, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:51.408616+00:00", "ended_at": "2026-08-25T01:05:55.125691+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cc6bc8b6-c508-45d5-8e02-e1a17fc4ac61", "name": "candid-orderly-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37194, "username": "tempuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:40.300857+00:00", "ended_at": "2026-08-25T01:05:47.107710+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "f9f2c3b3-1ebf-45e4-8a43-64e3627c987e", "name": "nautical-canny-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51786, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:29.634061+00:00", "ended_at": "2026-08-25T01:05:35.306320+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28bca817-39ee-4c21-acca-5ee8c5227fb2", "name": "quartz-crimson-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54682, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:19.609451+00:00", "ended_at": "2026-08-25T01:05:24.929201+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "69cc582a-98c9-4b5c-a88a-0edb495a0461", "name": "austere-silent-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32778, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:10.088419+00:00", "ended_at": "2026-08-25T01:05:16.915162+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "8b86fbfc-1c40-4cac-ae59-9b0a38f51fdd", "name": "lucid-stoic-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40422, "username": "sonar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 227, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:05:05.812816+00:00", "ended_at": "2026-08-25T01:05:12.404661+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f98d145e-88df-4f6f-b7a7-0231c2a220a0", "name": "feathered-fabled-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40406, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:52.814111+00:00", "ended_at": "2026-08-25T01:04:58.806274+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "9b7fcdc7-4322-406b-b8e9-a0c68fedea3f", "name": "grassy-fierce-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43330, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:38.698219+00:00", "ended_at": "2026-08-25T01:04:42.708821+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4dcc279b-cb49-49aa-8288-ab21dc82e579", "name": "honest-humble-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54614, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:34.118574+00:00", "ended_at": "2026-08-25T01:04:37.595448+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92635627-2375-40a6-99b8-fc7f7357d5c3", "name": "tangled-crisp-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43182, "username": "kubernetes", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:31.900562+00:00", "ended_at": "2026-08-25T01:04:37.299933+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "1e596c8f-c3a2-46f5-b4ce-3d492a48940e", "name": "amber-tawny-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33820, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:09.023354+00:00", "ended_at": "2026-08-25T01:04:14.831320+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "016a19c2-72d5-4725-ac7a-dea323ffad50", "name": "coastal-drifting-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47158, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:08.942470+00:00", "ended_at": "2026-08-25T01:04:11.895357+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "26551a47-eaf4-4ee6-8e2b-34d7992bafea", "name": "frank-wiry-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33838, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:04:04.212193+00:00", "ended_at": "2026-08-25T01:04:09.230013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5149251-279e-4f29-8fa2-25d58a73f955", "name": "mossy-hazy-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53018, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:47.109096+00:00", "ended_at": "2026-08-25T01:03:50.517875+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "06c12eba-a9c1-4110-88ea-9b8ba98d2575", "name": "coral-regal-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46736, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:40.988431+00:00", "ended_at": "2026-08-25T01:03:47.003921+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51146482-55ad-47f0-b0c6-8737a2cec4cc", "name": "sandy-plush-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40588, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:36.226030+00:00", "ended_at": "2026-08-25T01:03:41.506264+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07e33b60-aa49-4b7b-b652-e9cce6626883", "name": "civil-wooded-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47608, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:36.127014+00:00", "ended_at": "2026-08-25T01:03:44.312547+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "781509d0-3cb1-46e6-9a06-f3e343833a9b", "name": "opal-calm-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51376, "username": "qw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:23.094275+00:00", "ended_at": "2026-08-25T01:03:31.309459+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "a62f6347-e383-45be-bea4-adfa3b74eaf2", "name": "gloomy-blunt-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39484, "username": "factorio", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:11.812579+00:00", "ended_at": "2026-08-25T01:03:18.208434+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "15121971-d7c8-46ca-a9ec-8101dcf0d5dc", "name": "lanky-burly-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51366, "username": "ivan", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:03:11.620521+00:00", "ended_at": "2026-08-25T01:03:17.488562+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4865477b-458e-47c4-bfb5-91a1589d4faf", "name": "noble-balmy-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36316, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:02:52.305384+00:00", "ended_at": "2026-08-25T01:02:57.107006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e0f4f0b-909d-4ce6-afd5-85e7970e431b", "name": "blunt-smoky-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51496, "username": "jack", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:02:46.523707+00:00", "ended_at": "2026-08-25T01:02:54.410181+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "98e3e967-ab13-4032-9a79-ed1e5331e870", "name": "daring-tidal-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56644, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:02:41.532245+00:00", "ended_at": "2026-08-25T01:02:47.137945+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c05cbfa-d2b4-40f7-a92c-51ea38210460", "name": "solar-muted-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35236, "username": "super", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:02:34.723662+00:00", "ended_at": "2026-08-25T01:02:41.512497+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "35adaa23-34c1-46cb-ab16-049729206f39", "name": "hardy-russet-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35234, "username": "user10", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:02:26.899211+00:00", "ended_at": "2026-08-25T01:02:34.417153+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d0bd3ec0-1dba-4c35-8c47-fb0ead7468e7", "name": "woven-burly-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50344, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:02:03.815012+00:00", "ended_at": "2026-08-25T01:02:09.728530+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a2262a2e-5aa1-40fe-a94e-3d7f38a9fa15", "name": "amber-ivory-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44082, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:58.807177+00:00", "ended_at": "2026-08-25T01:02:03.036228+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "081e7fdb-fad1-4525-899c-cf6577ac0cea", "name": "rambling-daring-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51662, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:53.507895+00:00", "ended_at": "2026-08-25T01:01:58.120950+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "30ec9467-715b-4601-b81f-63eff23c010b", "name": "rambling-painted-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50794, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:47.011627+00:00", "ended_at": "2026-08-25T01:01:49.905572+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fbf2665b-731d-4d1d-82bf-88dc046199d6", "name": "ginger-brave-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40810, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:44.499668+00:00", "ended_at": "2026-08-25T01:01:51.494696+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "8588fc5c-d209-46ee-a9b9-ff24a3565665", "name": "umber-western-salmon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40794, "username": "monitor", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:34.191413+00:00", "ended_at": "2026-08-25T01:01:40.003088+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "56fa29d3-4b5b-4bd5-8017-8f1296a1026b", "name": "keen-mellow-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54484, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:21.594304+00:00", "ended_at": "2026-08-25T01:01:28.429277+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ad31087b-0667-436e-b215-f22486d8c372", "name": "coastal-icy-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39746, "username": "demo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:13.801304+00:00", "ended_at": "2026-08-25T01:01:20.115320+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "1d0b6ad9-196d-4e54-88a5-982b2f157d75", "name": "vivid-northern-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51184, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:01:12.204151+00:00", "ended_at": "2026-08-25T01:01:15.211897+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9e393f01-48ce-4434-9e2e-64a863d70d1b", "name": "boreal-freckled-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33288, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:43.525781+00:00", "ended_at": "2026-08-25T01:00:47.602013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12c33541-020b-445d-a637-6efdff475b2f", "name": "tidal-fabled-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33264, "username": "labuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:42.308699+00:00", "ended_at": "2026-08-25T01:00:49.724605+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "166bd83b-727d-4574-92e5-994b1cd263f4", "name": "indigo-craggy-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58956, "username": "bitrix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:30.220317+00:00", "ended_at": "2026-08-25T01:00:38.417312+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7037bfae-c7f2-4d57-9489-6623a52c071a", "name": "jolly-steady-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45020, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:25.411056+00:00", "ended_at": "2026-08-25T01:00:30.709828+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45d8cc59-13a0-477e-a725-898c8a6b837f", "name": "brisk-cheerful-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43836, "username": "martin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:18.970782+00:00", "ended_at": "2026-08-25T01:00:24.115676+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6ff5e5db-c0b5-4be6-a7ab-c8babc9b8924", "name": "hearty-twilight-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52200, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:16.611871+00:00", "ended_at": "2026-08-25T01:00:21.341498+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed71bd9b-ff6e-4535-bd2c-c54b4294438f", "name": "early-quiet-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43830, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T01:00:06.919543+00:00", "ended_at": "2026-08-25T01:00:15.611960+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "286dac27-20ac-4900-b01b-1f13e58505ef", "name": "ruddy-icy-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56754, "username": "aiuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:50.902745+00:00", "ended_at": "2026-08-25T00:59:56.204251+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a6aa24e6-0a3a-4b01-8db2-926e2107df48", "name": "forlorn-chilly-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35200, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:43.631057+00:00", "ended_at": "2026-08-25T00:59:46.605911+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90e9329e-e970-4404-aa5a-112d11a64693", "name": "ashen-gloomy-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37898, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:37.690613+00:00", "ended_at": "2026-08-25T00:59:40.522401+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2c9eac68-a7e5-407c-ad27-82c7e3feb325", "name": "downy-quaint-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38114, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:25.302064+00:00", "ended_at": "2026-08-25T00:59:31.807513+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a9d95ec3-48ce-4feb-abb8-6b965bda6184", "name": "merry-amber-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38298, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:20.508740+00:00", "ended_at": "2026-08-25T00:59:25.700398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "194766d0-6ef6-4a10-a256-b668880aa258", "name": "pristine-seaward-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38090, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:10.616502+00:00", "ended_at": "2026-08-25T00:59:16.089378+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a89c55d-d274-4b6f-a5bd-08e7e10babb6", "name": "mottled-idle-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38222, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:59:05.308349+00:00", "ended_at": "2026-08-25T00:59:08.003178+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f9588a5f-a7a6-4cbf-a77b-c88326fb6b12", "name": "somber-plush-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46850, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:58:50.504512+00:00", "ended_at": "2026-08-25T00:58:58.503327+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "1758a9d6-ffc3-451f-afee-484772db0706", "name": "civil-dewy-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59702, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:58:48.705333+00:00", "ended_at": "2026-08-25T00:58:54.509529+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "32fcaf0f-c725-408c-8737-2fe7c683e729", "name": "cunning-lonesome-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34888, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:58:37.913656+00:00", "ended_at": "2026-08-25T00:58:41.324092+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7593496b-3559-498e-a52b-5c90a6aaff16", "name": "mellow-scarlet-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44250, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:58:27.615531+00:00", "ended_at": "2026-08-25T00:58:30.288351+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "70e11c34-6722-4f1d-bd6d-86ec1e90503f", "name": "calm-primal-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44246, "username": "localhost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:58:26.195604+00:00", "ended_at": "2026-08-25T00:58:33.109063+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "558a80e1-23a7-45dc-82ac-f2d5c5b553ad", "name": "peaty-electric-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40756, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:58:10.606852+00:00", "ended_at": "2026-08-25T00:58:13.401261+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee52835d-9c8a-4236-a5d9-b7d982c700e8", "name": "rambling-tangled-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45566, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:59.911631+00:00", "ended_at": "2026-08-25T00:58:06.022682+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d668bdd9-f37e-4976-98c3-7a94c23fce01", "name": "lanky-pewter-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56414, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:59.709679+00:00", "ended_at": "2026-08-25T00:58:07.903302+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "042b9ddf-9c5c-4ddd-afb3-f6550d97c75c", "name": "fabled-thorny-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42904, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:54.006210+00:00", "ended_at": "2026-08-25T00:57:58.812652+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "67fe527d-3ac2-4b11-a821-61487d3c4d75", "name": "cosmic-thorny-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42894, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:36.504037+00:00", "ended_at": "2026-08-25T00:57:40.912481+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2b4296b4-53f2-401b-b349-0a4889256ac3", "name": "feathered-subtle-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38578, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:35.023441+00:00", "ended_at": "2026-08-25T00:57:41.793238+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "da3517e7-05af-4d32-81cd-bc8ea1aa64ab", "name": "granite-serene-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37372, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:27.910216+00:00", "ended_at": "2026-08-25T00:57:35.713126+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "545b9568-3da4-4e4d-8fd3-c8903efe415f", "name": "alpine-gleaming-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46956, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:13.604622+00:00", "ended_at": "2026-08-25T00:57:19.390885+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "93888ba3-0198-49e3-8cf3-aab5f4eb48d1", "name": "sullen-thrifty-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53692, "username": "test2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:06.408588+00:00", "ended_at": "2026-08-25T00:57:14.409109+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "61ea326a-2242-4766-9dd2-65bacc94ad33", "name": "ginger-orderly-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47660, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:57:00.000567+00:00", "ended_at": "2026-08-25T00:57:05.629027+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8ed96cb2-104e-462a-8c93-7022500d0257", "name": "vigilant-shaded-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44170, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:42.416770+00:00", "ended_at": "2026-08-25T00:56:47.911804+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7345b23b-168c-49df-be1f-0f6e8a3ea210", "name": "grassy-drifting-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44180, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:40.912099+00:00", "ended_at": "2026-08-25T00:56:45.906441+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86d6fe0e-cb2e-4190-a14b-55ce0bc81a38", "name": "languid-woven-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55578, "username": "recorder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:33.009151+00:00", "ended_at": "2026-08-25T00:56:38.516265+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "95258a90-908b-4082-9e75-60553c5e6ec8", "name": "pristine-alpine-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59288, "username": "angel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:29.007695+00:00", "ended_at": "2026-08-25T00:56:36.508227+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "bd17ab07-befa-457c-b88f-b46dcd4760f2", "name": "grassy-amiable-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48428, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:14.517903+00:00", "ended_at": "2026-08-25T00:56:21.016641+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "847211e5-f6c7-485f-9bde-21c85bd4a4fe", "name": "mottled-courtly-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54798, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:10.804682+00:00", "ended_at": "2026-08-25T00:56:16.705461+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "229d1235-6753-40a5-bade-2709a3f19f36", "name": "opal-frank-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32958, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:56:07.425488+00:00", "ended_at": "2026-08-25T00:56:12.809545+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c8edf63d-eb71-48ff-9773-1dfceccdddb9", "name": "reedy-tranquil-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 32934, "username": "vbox", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:55:55.848172+00:00", "ended_at": "2026-08-25T00:56:01.431408+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a1c64a4c-cd94-40a5-812f-fef97cd05000", "name": "gilded-nautical-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38000, "username": "fred", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:55:42.417856+00:00", "ended_at": "2026-08-25T00:55:48.605692+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "17e685d1-23c9-48c4-9167-51a6e6ea3189", "name": "placid-fierce-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44428, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:55:27.109899+00:00", "ended_at": "2026-08-25T00:55:30.997478+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "27ae847d-f81e-4647-8dc4-63364c73b4de", "name": "blunt-thorny-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38536, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:55:26.192774+00:00", "ended_at": "2026-08-25T00:55:31.201315+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f623ea00-6b59-476e-b79d-44ab277c5b65", "name": "flinty-cunning-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56300, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:55:24.914693+00:00", "ended_at": "2026-08-25T00:55:30.519026+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c73eb2e9-8ef3-49cd-95ef-f81abcb6674a", "name": "jolly-loyal-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33326, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:55:18.825540+00:00", "ended_at": "2026-08-25T00:55:25.710427+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d29bfccd-e3e8-47e0-b82e-458fc60ed391", "name": "earnest-lively-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33322, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:52.309896+00:00", "ended_at": "2026-08-25T00:54:57.638670+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3693ef44-a14c-4906-b148-384e01096092", "name": "vigilant-ashen-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51206, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:47.407864+00:00", "ended_at": "2026-08-25T00:54:52.294227+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4c68432b-e838-4b24-8aac-22e44b56a3f0", "name": "grumpy-languid-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44186, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:45.119956+00:00", "ended_at": "2026-08-25T00:54:53.108003+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f112d664-af79-45e4-9146-77012295aba7", "name": "cobalt-vaulted-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36924, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:44.824470+00:00", "ended_at": "2026-08-25T00:54:49.626650+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c7a35f0f-656b-43bb-8843-920fd791d67b", "name": "murky-craggy-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51910, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:25.803235+00:00", "ended_at": "2026-08-25T00:54:28.916130+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "de09958d-a8a2-4c2d-880e-25ba4120a275", "name": "opal-burly-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51384, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:17.915260+00:00", "ended_at": "2026-08-25T00:54:23.993395+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f351219-03ca-4532-9594-fbd47c9bf80f", "name": "subtle-rambling-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45272, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:14.012702+00:00", "ended_at": "2026-08-25T00:54:21.702781+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "6d253dae-98a6-40bf-ad7c-97310522ba56", "name": "sleepy-cosmic-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42386, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:03.006506+00:00", "ended_at": "2026-08-25T00:54:08.604342+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "58ccdcb6-0556-4d89-8b40-3b2bdfbbc897", "name": "chilly-early-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42404, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:54:00.902855+00:00", "ended_at": "2026-08-25T00:54:05.297438+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d722c5fd-cd1b-4d94-9293-251e2b8b7b3f", "name": "steady-noble-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52946, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:53:42.917808+00:00", "ended_at": "2026-08-25T00:53:45.707441+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd0e9fab-3959-4af5-bb97-94dce9a4c8c0", "name": "wandering-bitter-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37650, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:53:32.230643+00:00", "ended_at": "2026-08-25T00:53:39.806508+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "e0fe6389-187a-4784-8084-4062a38ed6b1", "name": "whispering-mossy-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45034, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:53:31.815393+00:00", "ended_at": "2026-08-25T00:53:35.491221+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d652d09f-a022-4f74-a39e-63308a73a8b9", "name": "quartz-jovial-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 38832, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:53:27.059628+00:00", "ended_at": "2026-08-25T00:53:35.418369+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "9260c995-2c6a-411f-8e5f-42ce36164466", "name": "gnarled-dapper-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35452, "username": "config", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:53:15.611895+00:00", "ended_at": "2026-08-25T00:53:21.307253+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a315537f-e656-49f8-9808-8af1e2d86789", "name": "fearless-brave-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35440, "username": "fivem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:53:03.411614+00:00", "ended_at": "2026-08-25T00:53:11.106363+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "4850442b-04e8-4d35-9214-193567882e89", "name": "vaulted-emerald-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56326, "username": "liyang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:58.209755+00:00", "ended_at": "2026-08-25T00:53:07.108291+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2986088e-8e1d-4116-9ef7-539e5eb0f696", "name": "ruddy-keen-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 50146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:38.413200+00:00", "ended_at": "2026-08-25T00:52:43.293179+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4dd897a-cbd9-426c-beec-c7e07a8d5002", "name": "misty-gallant-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33842, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:31.001378+00:00", "ended_at": "2026-08-25T00:52:35.622366+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73e42386-7a05-4b0e-a07c-d041738f7977", "name": "vigilant-northern-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57566, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:30.917025+00:00", "ended_at": "2026-08-25T00:52:39.602642+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "d4c53811-1c53-455f-a7d6-c41150765505", "name": "jagged-dapper-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57576, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:30.626220+00:00", "ended_at": "2026-08-25T00:52:35.905844+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1022925f-4df2-4e1e-9bbe-8a96cdea34e1", "name": "nautical-freckled-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48624, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:09.797370+00:00", "ended_at": "2026-08-25T00:52:15.205899+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8039bd06-06e9-4f57-a16a-7fa0b7fe6e83", "name": "hardy-placid-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 51646, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:04.621417+00:00", "ended_at": "2026-08-25T00:52:08.303148+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c1a717c3-427c-42c5-b4af-aa0e4a183444", "name": "blithe-hidden-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39850, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:52:01.307991+00:00", "ended_at": "2026-08-25T00:52:09.534491+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "09a79b2a-bf9a-4d0f-ba80-7567e3829384", "name": "dappled-fabled-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58412, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:49.389022+00:00", "ended_at": "2026-08-25T00:51:52.703376+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f105eb9-c8c8-455f-978d-d1c03fba6932", "name": "inland-feral-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 41006, "username": "tom", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:44.711817+00:00", "ended_at": "2026-08-25T00:51:50.125616+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "56ac9eba-c117-47de-ab3b-d2c92c7c4d38", "name": "meadow-jaunty-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "119.209.12.20", "src_port": 60480, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 643, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T00:51:43.073455+00:00", "ended_at": "2026-08-25T00:51:43.274634+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3508 }, { "id": "dc3a4fb3-2f6f-49c2-801f-765138d64ff1", "name": "dewy-thrifty-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35998, "username": "opc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:36.422299+00:00", "ended_at": "2026-08-25T00:51:42.404067+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4b431b2b-d2db-4cf9-b9c9-235ce862bbd9", "name": "hardy-craggy-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35972, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 234, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:22.224318+00:00", "ended_at": "2026-08-25T00:51:27.728589+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42b2eb45-a3a3-411f-8280-d44015dcef1d", "name": "proud-icy-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43066, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:17.013481+00:00", "ended_at": "2026-08-25T00:51:23.095955+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "810f17ab-3d53-4815-bcdb-83c05dfc871c", "name": "bronzed-indigo-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46066, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:08.100341+00:00", "ended_at": "2026-08-25T00:51:14.216582+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "63b24dc2-be03-4a2a-9e84-cf12e5d1af9d", "name": "jovial-dapper-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59964, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 185, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:51:02.605019+00:00", "ended_at": "2026-08-25T00:51:07.429679+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f475b6c-5b75-495f-baa8-320b80a70f21", "name": "electric-supple-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58168, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:50:47.909891+00:00", "ended_at": "2026-08-25T00:50:53.202048+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "ef752d03-bd26-43a4-8d6d-a4173e70bc5c", "name": "dusty-lucid-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 49146, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:50:42.890247+00:00", "ended_at": "2026-08-25T00:50:45.708843+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "184b94fe-c692-4c5a-bc00-94f23a780f25", "name": "fabled-humble-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39048, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:50:30.504154+00:00", "ended_at": "2026-08-25T00:50:38.305141+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "d2020ee8-fdfa-442d-a00f-2ffa8d4cd904", "name": "serene-ginger-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58156, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:50:29.790723+00:00", "ended_at": "2026-08-25T00:50:33.997015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f1d79339-30eb-45ac-becc-2ea9076e6383", "name": "mindful-twilight-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45128, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:50:12.101643+00:00", "ended_at": "2026-08-25T00:50:15.125319+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ade1c9a-c770-42f7-ac20-b6f76aaa94c1", "name": "cunning-lively-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45214, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:50:06.505113+00:00", "ended_at": "2026-08-25T00:50:09.813151+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6b11bdd9-2b9f-486f-8a32-b41287f8f727", "name": "brisk-shaded-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43202, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:49:55.914167+00:00", "ended_at": "2026-08-25T00:50:01.906652+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eda1d3fb-02ff-4f1f-a9bb-3ad6d16c6d24", "name": "lucid-keen-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 43180, "username": "uploader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:49:54.511808+00:00", "ended_at": "2026-08-25T00:49:59.903504+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "2d63522d-3133-4b98-bcba-cade9da0483d", "name": "calm-frank-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47114, "username": "newuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:49:42.509961+00:00", "ended_at": "2026-08-25T00:49:49.521559+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "c79f5359-97bc-45d2-a925-862db6378c90", "name": "umber-crisp-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 44282, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:49:34.605620+00:00", "ended_at": "2026-08-25T00:49:38.814598+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2cfe2ab6-46af-4e7e-99d6-a0cbf9296535", "name": "cosmic-bitter-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45764, "username": "Caps", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:49:28.824151+00:00", "ended_at": "2026-08-25T00:49:33.812764+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "c6d9f4e2-fd52-45c4-931c-501f1e65b300", "name": "mossy-regal-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46426, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:49:23.512784+00:00", "ended_at": "2026-08-25T00:49:29.016988+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "46568e21-743b-4665-8377-b3263ff9f6bb", "name": "nautical-regal-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 34656, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:59.132306+00:00", "ended_at": "2026-08-25T00:49:04.010219+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9bcf0a2a-376a-4be5-80cf-3de82cce80d2", "name": "austere-canny-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56098, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:55.199640+00:00", "ended_at": "2026-08-25T00:48:58.611310+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d06da771-8331-4695-a640-2d9bb53ccac7", "name": "feathered-fearless-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56082, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:49.806189+00:00", "ended_at": "2026-08-25T00:48:54.311001+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3c1f8f93-37ce-4fc1-936b-b807b1f94f4b", "name": "merry-tangled-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 37712, "username": "odoo17", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:47.604191+00:00", "ended_at": "2026-08-25T00:48:54.013336+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ea3ef059-5ac4-4423-947d-b5422119396e", "name": "restless-autumn-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 48340, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:36.903094+00:00", "ended_at": "2026-08-25T00:48:45.411871+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "06219570-dcab-47fa-82bc-0ffe7f7b1884", "name": "fierce-meadow-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 42946, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:30.814343+00:00", "ended_at": "2026-08-25T00:48:36.713769+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1b65036f-bb9e-4415-b62c-b7549ea71421", "name": "tangled-nimble-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60324, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:17.194995+00:00", "ended_at": "2026-08-25T00:48:20.319180+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c64d45db-6a6f-4bbf-90b8-fcfc6bf87cb3", "name": "woven-vaulted-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60316, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:13.404199+00:00", "ended_at": "2026-08-25T00:48:19.807871+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ae8446ae-dd06-4bc3-8555-63a2ecec9be8", "name": "noble-northern-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 47574, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:48:08.715064+00:00", "ended_at": "2026-08-25T00:48:16.213374+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "a27cdc4d-45cb-435a-ad25-9d57504bbc50", "name": "umber-sturdy-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53232, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:51.990279+00:00", "ended_at": "2026-08-25T00:47:56.302276+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ce14c3f-41c0-45d4-ba86-6ef4a2dbbc00", "name": "verdant-grassy-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56746, "username": "almalinux", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:46.004393+00:00", "ended_at": "2026-08-25T00:47:54.115016+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "3ed4b44e-133e-4ffa-8594-bfe268c66bf4", "name": "craggy-gilded-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54468, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:42.311955+00:00", "ended_at": "2026-08-25T00:47:48.199753+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e4ae4dca-8214-4d46-aa36-66ebb107f6f9", "name": "mottled-jovial-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46914, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:40.207391+00:00", "ended_at": "2026-08-25T00:47:48.305108+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9f8788bd-ec2b-4392-9f0f-2d812075afda", "name": "buoyant-bashful-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46912, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:16.712080+00:00", "ended_at": "2026-08-25T00:47:21.124724+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58f249d8-3c54-4d73-9bc7-9c01937bc82c", "name": "solar-upland-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60804, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:10.005082+00:00", "ended_at": "2026-08-25T00:47:13.015064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1cfbed42-6026-4e47-88ca-07b7e300f46a", "name": "hearty-jolly-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33516, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:47:03.901054+00:00", "ended_at": "2026-08-25T00:47:07.607357+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0651b4f2-b574-423b-82d1-10d44f2ddcc9", "name": "rugged-opal-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 36384, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:46:48.105209+00:00", "ended_at": "2026-08-25T00:46:53.501570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5560932f-d992-4cf6-8eb1-81193d0580aa", "name": "craggy-alpine-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57992, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:46:33.414491+00:00", "ended_at": "2026-08-25T00:46:41.123370+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "1b2d41a8-486f-4c93-9721-8fbf70cfcb36", "name": "loyal-nautical-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45438, "username": "wso2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:46:07.610146+00:00", "ended_at": "2026-08-25T00:46:13.404819+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "ca37ebd5-a51b-48a3-ad3e-02fe8e058d5d", "name": "upland-rustic-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 45432, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:46:00.723128+00:00", "ended_at": "2026-08-25T00:46:04.410790+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "364b1eb0-e77c-4bd8-82a5-029490948977", "name": "indigo-candid-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 54240, "username": "odoo14", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:45:50.515022+00:00", "ended_at": "2026-08-25T00:45:54.404262+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2e79b0a9-6a7f-4acd-8d89-eec47942ebcf", "name": "canny-tender-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 60800, "username": "azureuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:45:44.107243+00:00", "ended_at": "2026-08-25T00:45:48.911634+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "c6b7ef3b-7267-44eb-9425-d0cc147a2cb2", "name": "patient-gallant-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 40084, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:45:31.523405+00:00", "ended_at": "2026-08-25T00:45:33.598096+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "45e72e6e-f71c-4657-82f6-0444f08017a3", "name": "watchful-quiet-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 55886, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:45:26.998598+00:00", "ended_at": "2026-08-25T00:45:30.914664+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c9191a36-21ed-4ad4-85a0-a075936b1ffe", "name": "patient-brave-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46302, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:45:18.290026+00:00", "ended_at": "2026-08-25T00:45:22.314688+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "d560180f-df7b-4981-b34e-b9a83a7c313b", "name": "frank-fearless-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 46282, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:45:06.620089+00:00", "ended_at": "2026-08-25T00:45:08.224884+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "75cb9dc5-850d-426e-93f6-c96cb8b441dd", "name": "hardy-plucky-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 57516, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:44:59.314113+00:00", "ended_at": "2026-08-25T00:45:02.724331+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "4bcea659-ffd1-4072-8f69-73ec18f993b9", "name": "genial-somber-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 56408, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:44:52.019495+00:00", "ended_at": "2026-08-25T00:44:54.108424+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4a519bdc-47a9-40ed-9f0a-da8b73a465ee", "name": "brave-feral-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 53746, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:44:44.700684+00:00", "ended_at": "2026-08-25T00:44:48.906782+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "4749d262-f0a9-4727-9765-7fd5f3f5914d", "name": "honest-feral-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 33706, "username": "webmaster", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:44:28.924367+00:00", "ended_at": "2026-08-25T00:44:32.807148+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "22701cd5-f37d-434c-bb44-5be7164c3bfb", "name": "sturdy-gritty-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 35928, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:44:15.516181+00:00", "ended_at": "2026-08-25T00:44:18.502391+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8eb7b968-5d13-412a-994f-3c3c9448e021", "name": "dewy-curious-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39392, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:44:08.021497+00:00", "ended_at": "2026-08-25T00:44:11.012884+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "6fb39d34-cd6c-44bf-b2ea-ee879d81fbb3", "name": "slender-sullen-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 39386, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:43:58.399096+00:00", "ended_at": "2026-08-25T00:43:59.096122+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eca73263-329e-4999-8729-7fdee3a2a8b0", "name": "mellow-sandy-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 59776, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:43:42.114792+00:00", "ended_at": "2026-08-25T00:43:42.737915+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8e473d1a-0532-4782-ba39-5cb2483f46bc", "name": "prickly-pleasant-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 52242, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:43:34.119254+00:00", "ended_at": "2026-08-25T00:43:36.909632+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "7f9ab91c-1e81-4a10-8258-4f4f827c4eea", "name": "lucid-candid-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.153.34.165", "src_port": 58986, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-25T00:43:25.214706+00:00", "ended_at": "2026-08-25T00:43:28.626200+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "e43cf21d-da59-4fb6-a40a-f989fe0b0c5d", "name": "fleeting-marbled-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "113.161.222.150", "src_port": 39120, "username": "frontend", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T23:29:11.643837+00:00", "ended_at": "2026-08-24T23:29:11.885751+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 6651 }, { "id": "720af6ad-98e8-4b27-a642-3b871d4b908a", "name": "dapper-clever-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.165.190.208", "src_port": 34868, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 558, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T22:07:11.630448+00:00", "ended_at": "2026-08-24T22:07:11.802058+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 6826 }, { "id": "33711d99-bb98-4dec-8455-b964f5c6c109", "name": "ashen-languid-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.153.205.159", "src_port": 39638, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 782, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T22:04:42.105280+00:00", "ended_at": "2026-08-24T22:04:42.350865+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3989 }, { "id": "f6f3ca3f-8bb8-4346-9617-014935b9dd74", "name": "burly-patient-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "141.95.54.130", "src_port": 59206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T21:25:17.339639+00:00", "ended_at": "2026-08-24T21:25:17.428604+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4003 }, { "id": "3f4555b7-f2b2-4f80-be0f-522dc8d48d29", "name": "daring-plush-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "150.136.214.177", "src_port": 31390, "username": "feria", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 63, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T20:05:26.773233+00:00", "ended_at": "2026-08-24T20:05:26.779502+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3343 }, { "id": "46ec8e9e-9279-4a6b-b5ea-d2df6efaa50b", "name": "windswept-downy-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "121.184.144.232", "src_port": 55395, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 613, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T19:36:55.316711+00:00", "ended_at": "2026-08-24T19:36:55.506740+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3955 }, { "id": "888b5309-3f8d-4125-8ea4-144dfaf1130b", "name": "lunar-gritty-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.35.110.147", "src_port": 34518, "username": "accounting", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 417, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T19:09:01.642120+00:00", "ended_at": "2026-08-24T19:09:01.768877+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4304 }, { "id": "67d5f6ce-be29-48d2-a412-7fdabda56506", "name": "solemn-leafy-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "87.106.29.151", "src_port": 41442, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T19:09:01.160303+00:00", "ended_at": "2026-08-24T19:09:01.247837+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4113 }, { "id": "eef8ef1f-b5a0-4b1f-87e9-bc3ed4e4ceed", "name": "cobalt-quartz-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "65.181.71.117", "src_port": 58331, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 688, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T18:23:59.758849+00:00", "ended_at": "2026-08-24T18:23:59.971970+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3226 }, { "id": "bc359e45-55ba-409e-93c6-17db2ba5c4c0", "name": "shaded-hazy-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.12.221.15", "src_port": 41514, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T16:31:38.860509+00:00", "ended_at": "2026-08-24T16:31:38.948523+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3259 }, { "id": "1eb2e852-b7ac-4cfc-825c-6620400edb12", "name": "dewy-nautical-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.119.48.179", "src_port": 55760, "username": "jarservice", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T16:28:31.114422+00:00", "ended_at": "2026-08-24T16:28:31.203018+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3462 }, { "id": "3c7678b6-8be4-4003-89a0-62a96e45e99f", "name": "pewter-lucid-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.164.57.37", "src_port": 55784, "username": "crafty", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 713, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T16:21:45.170200+00:00", "ended_at": "2026-08-24T16:21:45.395008+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3248 }, { "id": "d3cec385-30ea-429b-b6ce-fdb32fe3cc43", "name": "misty-keen-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59458, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 166, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:54.611098+00:00", "ended_at": "2026-08-24T10:18:58.479727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e3999b14-c6b0-4376-ae1a-a4f464daaf05", "name": "snowy-ruddy-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38114, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 163, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:46.745438+00:00", "ended_at": "2026-08-24T10:18:52.085271+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ed89e3c5-3cdf-4a4f-9b7b-22d453663984", "name": "proud-sullen-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38354, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 168, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:41.394234+00:00", "ended_at": "2026-08-24T10:18:47.328133+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7eaf8c9-e06a-4f0f-b276-b0aaf3f04fc0", "name": "tidal-crystal-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35556, "username": "onkar", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:29.203285+00:00", "ended_at": "2026-08-24T10:18:36.564670+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "6b699d83-5995-4531-a931-2a9d4a98a0cc", "name": "austere-chilly-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38340, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 169, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:27.208050+00:00", "ended_at": "2026-08-24T10:18:30.055738+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd2cf142-3a6b-40ce-b18b-0643bd558915", "name": "balmy-sturdy-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36752, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:20.643471+00:00", "ended_at": "2026-08-24T10:18:26.008627+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5eea33e4-4c04-4a12-a930-3f3613aedd5e", "name": "plush-fierce-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36738, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:16.932580+00:00", "ended_at": "2026-08-24T10:18:22.403314+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a0f4fa29-e015-4d6c-82e1-a98d48d613c2", "name": "marbled-dapper-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38728, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 342, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:18:03.739184+00:00", "ended_at": "2026-08-24T10:18:06.683346+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5845af39-0e6f-4233-adff-3f30b3aa891a", "name": "civil-vaulted-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60450, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:57.224218+00:00", "ended_at": "2026-08-24T10:18:02.348538+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2ed9aa1-f601-4f48-ba67-f9027f15d17f", "name": "rambling-reedy-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38714, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:43.912073+00:00", "ended_at": "2026-08-24T10:17:48.704573+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80df7069-12f9-4ca9-9a44-0feeba8f0acd", "name": "misty-fickle-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49222, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:43.186158+00:00", "ended_at": "2026-08-24T10:17:46.442638+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "23f27408-b2e3-44da-b99a-8a8c05546c5b", "name": "brisk-glacial-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54608, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:36.500224+00:00", "ended_at": "2026-08-24T10:17:40.907597+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8be51da3-101b-42b5-b5c2-9888879c03cb", "name": "cobalt-sleepy-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54614, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:35.410781+00:00", "ended_at": "2026-08-24T10:17:40.712105+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c280ec70-6b19-446c-8616-cd5a212d3823", "name": "crisp-supple-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56560, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:22.045668+00:00", "ended_at": "2026-08-24T10:17:28.229786+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e1010af2-35f3-4a3f-beac-f58ce8014f99", "name": "vigilant-jagged-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40274, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:15.210556+00:00", "ended_at": "2026-08-24T10:17:19.701045+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1dec94c8-5051-4a9f-ba7f-14b4ba724029", "name": "downy-thawing-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60844, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:17:04.325043+00:00", "ended_at": "2026-08-24T10:17:07.420007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0bbfbbca-a189-43d2-8cd0-ddc6766dedd9", "name": "serene-oaken-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60828, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:58.716330+00:00", "ended_at": "2026-08-24T10:17:01.512665+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "89043c31-8f5a-47c1-849a-7c476392be5e", "name": "ruddy-shifting-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48378, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:56.088076+00:00", "ended_at": "2026-08-24T10:17:01.718084+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a9a914e7-5b82-4649-a19e-8ce3e0d0c937", "name": "ashen-pewter-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41462, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 345, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:52.644666+00:00", "ended_at": "2026-08-24T10:16:56.404097+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6fe12a23-27c4-4a74-994e-d311d70a531a", "name": "silent-indigo-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41434, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:46.207531+00:00", "ended_at": "2026-08-24T10:16:49.902644+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "54d86b58-94d2-4a36-9b9b-ee53a0e5e5fd", "name": "obsidian-calm-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40178, "username": "odoo", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:32.908071+00:00", "ended_at": "2026-08-24T10:16:37.721300+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2388173c-85a6-47ad-8dbf-0e71514139a9", "name": "nautical-seaward-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46638, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:28.432039+00:00", "ended_at": "2026-08-24T10:16:32.007014+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ac4fee2d-198e-4fbb-90ea-5a3018defbad", "name": "austere-restless-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46624, "username": "crafty", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:25.029185+00:00", "ended_at": "2026-08-24T10:16:30.998288+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f2f39ba9-8fa5-4aac-84ae-e6592527667c", "name": "sooty-shaded-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57592, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:14.907833+00:00", "ended_at": "2026-08-24T10:16:18.718245+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a4478524-deb1-4255-922b-5522f3ccb79a", "name": "indigo-primal-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38896, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:16:01.507721+00:00", "ended_at": "2026-08-24T10:16:05.365865+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2027289e-db7b-4450-952d-246d85463935", "name": "cunning-prickly-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38880, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:59.402585+00:00", "ended_at": "2026-08-24T10:16:04.928410+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ebf1dfa6-7ece-4496-8186-107eb86b00e7", "name": "northern-merry-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50406, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:55.203920+00:00", "ended_at": "2026-08-24T10:15:59.626187+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4751e32d-3655-40bc-bb09-b2342b32c115", "name": "crimson-gentle-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49366, "username": "packer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:52.688286+00:00", "ended_at": "2026-08-24T10:15:58.243034+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a1abae72-02b1-4952-85f1-9ba44fe1aed7", "name": "mighty-jaunty-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47068, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:36.634203+00:00", "ended_at": "2026-08-24T10:15:39.608221+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "84d0a476-bcec-448b-b016-a88b75fa9f71", "name": "grassy-vaulted-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49350, "username": "hu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 187, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:34.710178+00:00", "ended_at": "2026-08-24T10:15:38.049719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "afc50726-836e-4527-994e-752f10a85a0d", "name": "courtly-canny-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52296, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:25.425906+00:00", "ended_at": "2026-08-24T10:15:29.737326+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5cf51bb0-ea8d-49c6-b7e5-459be609a420", "name": "sturdy-drifting-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52310, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:20.607107+00:00", "ended_at": "2026-08-24T10:15:25.533551+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c05b5b2c-d90f-4015-b7dc-2bc19bf046b6", "name": "russet-icy-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40114, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:12.906010+00:00", "ended_at": "2026-08-24T10:15:16.414436+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12146f26-c1c0-410b-966d-9b30582398be", "name": "pleasant-dewy-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54232, "username": "centos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:11.209026+00:00", "ended_at": "2026-08-24T10:15:19.620222+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "22f5f45e-c4f4-42a4-9386-67fe4fa5038c", "name": "western-candid-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38086, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:15:00.519477+00:00", "ended_at": "2026-08-24T10:15:03.182988+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "943361c6-79ba-47bc-a292-8ef8c6c7a9e9", "name": "sandy-alpine-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38084, "username": "odoo16", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:55.632140+00:00", "ended_at": "2026-08-24T10:15:01.787841+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "b5329355-dd84-40ec-bc89-2e08105a6b0b", "name": "genial-ancient-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33974, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:45.523844+00:00", "ended_at": "2026-08-24T10:14:50.308833+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "940df23b-8df1-416d-a1e5-6be63604e1e3", "name": "jagged-sincere-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 177, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:34.393190+00:00", "ended_at": "2026-08-24T10:14:39.734763+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4a4691eb-4323-4298-8346-fe1850628843", "name": "mindful-nameless-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40848, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:31.427525+00:00", "ended_at": "2026-08-24T10:14:37.334719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a1776fcc-a11b-4205-8266-19e441d5fa85", "name": "supple-mossy-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56468, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:21.483898+00:00", "ended_at": "2026-08-24T10:14:27.100608+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d243ed39-c83e-4391-895a-e83a07850d69", "name": "humble-inland-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50606, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:19.612907+00:00", "ended_at": "2026-08-24T10:14:23.006586+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e07bca1b-2a37-49a7-b979-3c9eab834d9d", "name": "shaded-chilly-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50602, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:11.731284+00:00", "ended_at": "2026-08-24T10:14:16.188626+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "91dcf51c-ebfd-4e8b-b336-2b918196f97a", "name": "nameless-thawing-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42598, "username": "vbox", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:14:11.334375+00:00", "ended_at": "2026-08-24T10:14:19.523122+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d746bd31-71e9-4104-90f0-7431bac985fd", "name": "brave-verdant-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38676, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:55.438274+00:00", "ended_at": "2026-08-24T10:13:59.618699+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e31c26bf-0b2f-4fc9-a036-4c4b2f1771a3", "name": "snowy-seaward-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44152, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:50.208137+00:00", "ended_at": "2026-08-24T10:13:54.011784+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "baa3ab13-ade4-4c13-b226-b785a28652db", "name": "shifting-bitter-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44142, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:47.448834+00:00", "ended_at": "2026-08-24T10:13:50.813411+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b35cafce-e24c-4de2-94dd-cbfdaf4bc977", "name": "russet-brave-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53396, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:35.106542+00:00", "ended_at": "2026-08-24T10:13:38.420587+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9250f1e3-89fe-46cd-ab67-1bbe5161199b", "name": "bashful-northern-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47368, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:28.536958+00:00", "ended_at": "2026-08-24T10:13:33.803730+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b75e95c7-46a0-4e54-907d-209d6d75cbb4", "name": "supple-bashful-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58698, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:19.937956+00:00", "ended_at": "2026-08-24T10:13:22.705215+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "72fc44a7-2590-4d38-81bb-7aaef5c6adbb", "name": "tranquil-lunar-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47366, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:17.591355+00:00", "ended_at": "2026-08-24T10:13:22.126002+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "76139c6a-b27c-423c-b698-a1e6904c89ac", "name": "muted-fleeting-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60900, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:14.908360+00:00", "ended_at": "2026-08-24T10:13:19.895609+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b4af95e-1319-41f3-a4ed-469ddd40b2bb", "name": "seaward-inland-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60886, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:01.147443+00:00", "ended_at": "2026-08-24T10:13:06.432188+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d1ce4151-f514-4900-99c7-ea96a670a813", "name": "graceful-creaky-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55494, "username": "init", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:13:00.293065+00:00", "ended_at": "2026-08-24T10:13:08.607734+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "7ee45898-3148-4d28-b014-004abe522bab", "name": "genial-crisp-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48866, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:54.407692+00:00", "ended_at": "2026-08-24T10:12:57.596881+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1b32e2c6-3a7b-45a8-9ab3-5060224f2c64", "name": "deft-distant-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54306, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:35.013480+00:00", "ended_at": "2026-08-24T10:12:38.133431+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0fceeba9-c9dc-4f3b-8e1a-1cbbb893cc2b", "name": "ashen-velvet-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54300, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:28.903890+00:00", "ended_at": "2026-08-24T10:12:35.006408+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d367692e-1993-4ce7-a86c-e7c7b80ef7cd", "name": "alpine-oaken-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37226, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:25.886326+00:00", "ended_at": "2026-08-24T10:12:29.317190+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a7fe839e-64a2-4a7a-b62a-b104d63bd0d0", "name": "earnest-sterling-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39444, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:15.476859+00:00", "ended_at": "2026-08-24T10:12:20.811261+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "33c51c19-ae19-4985-9ea4-ecd71bf5b1d5", "name": "gritty-spirited-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39426, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:12.416033+00:00", "ended_at": "2026-08-24T10:12:16.209966+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8d5fb635-86d4-408a-b845-c99f13d29f84", "name": "lively-stoic-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53280, "username": "fivem", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:00.727033+00:00", "ended_at": "2026-08-24T10:12:06.205102+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "91dab9b6-df13-4117-a069-4dc0a1835c40", "name": "ginger-smoky-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34018, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:12:00.516044+00:00", "ended_at": "2026-08-24T10:12:04.711425+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c156a51a-bd24-47ac-ab1f-a2c428208148", "name": "ashen-gloomy-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53286, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:55.524422+00:00", "ended_at": "2026-08-24T10:11:58.899131+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "16abc400-08b0-4b56-b087-b1caf4df5219", "name": "hazy-buoyant-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53878, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:44.205804+00:00", "ended_at": "2026-08-24T10:11:47.679134+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "22c71ac6-38ac-4292-a8a3-77093ab70274", "name": "weathered-thrifty-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41432, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:30.586707+00:00", "ended_at": "2026-08-24T10:11:33.210114+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2c86bdcc-67be-4825-b02e-c75f2cc91cfc", "name": "rugged-gnarled-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46598, "username": "ftpuser1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:29.731484+00:00", "ended_at": "2026-08-24T10:11:36.510352+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "66717ead-7cb4-49cf-a13a-b39fb5fe1b23", "name": "regal-wiry-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44412, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:27.694847+00:00", "ended_at": "2026-08-24T10:11:32.805175+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d90fe15e-34b2-4ce6-80cc-843e14e48ae8", "name": "amber-icy-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44402, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:17.151004+00:00", "ended_at": "2026-08-24T10:11:22.633489+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80df6a2d-eaa2-4236-9b23-5de4698798bd", "name": "vigilant-velvet-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56826, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:12.863245+00:00", "ended_at": "2026-08-24T10:11:16.039191+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "52e3e32c-c91d-46e5-b686-d853fad07fc6", "name": "frank-frugal-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56822, "username": "zahra", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:07.087837+00:00", "ended_at": "2026-08-24T10:11:13.121301+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ece2f223-f018-4df5-9e94-de2342509904", "name": "canny-ruddy-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45984, "username": "esroot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:11:04.596746+00:00", "ended_at": "2026-08-24T10:11:09.994165+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8f615ac3-1812-4c6d-a989-2802eec31d6b", "name": "dutiful-merry-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52184, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:48.435251+00:00", "ended_at": "2026-08-24T10:10:53.513254+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dc701664-08ee-49f9-a647-6c8bab0763ca", "name": "muted-thrifty-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52180, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:38.133789+00:00", "ended_at": "2026-08-24T10:10:40.941228+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d1276048-e7d9-4a10-94ca-30eb4d265cce", "name": "coral-seaward-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59114, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:28.808877+00:00", "ended_at": "2026-08-24T10:10:34.608061+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bd4b7e85-6f9f-43dc-b3b7-15b0705c79a4", "name": "creaky-calm-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33604, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:24.420543+00:00", "ended_at": "2026-08-24T10:10:30.029168+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2c23160-0fb8-4205-900f-de7db459a53d", "name": "cheerful-nimble-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41160, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:15.484137+00:00", "ended_at": "2026-08-24T10:10:18.208988+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0dca336d-1370-4a17-a22b-e095ebbdcb4e", "name": "plush-rustic-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41158, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:14.706225+00:00", "ended_at": "2026-08-24T10:10:19.988173+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "36ec0885-dc86-4010-b781-0c6c66fb8dc8", "name": "cheerful-cosmic-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42856, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:10:05.117048+00:00", "ended_at": "2026-08-24T10:10:08.848255+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "53c0a674-e9fd-4db7-b68d-2e1c2d5b64cb", "name": "smoky-crisp-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38260, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:57.390373+00:00", "ended_at": "2026-08-24T10:10:00.705328+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9913aab1-32c5-4a69-96fe-7d7b7c7c21bb", "name": "placid-ashen-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46540, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:45.516433+00:00", "ended_at": "2026-08-24T10:09:48.386728+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "49fd87a6-3488-46fd-9778-83422bccb7fb", "name": "restless-marbled-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38250, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:45.025709+00:00", "ended_at": "2026-08-24T10:09:49.536072+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "87fc1187-46b1-4b01-b706-713c797cad28", "name": "woven-quaint-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50594, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:34.189116+00:00", "ended_at": "2026-08-24T10:09:40.183659+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "593ef37e-8db7-4f99-9693-3fd1512ad226", "name": "western-honest-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45934, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:29.910373+00:00", "ended_at": "2026-08-24T10:09:34.441517+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "307e8e0b-c1da-4d11-a251-2c6aad8d0f25", "name": "murky-ruddy-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45914, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:19.604232+00:00", "ended_at": "2026-08-24T10:09:23.808585+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e1899cef-245c-4aba-b073-15c0ee7413e3", "name": "alpine-sunlit-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39908, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:10.929658+00:00", "ended_at": "2026-08-24T10:09:13.728274+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c32b2026-a2f6-47ef-8be2-98a136080b77", "name": "quiet-regal-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48946, "username": "user2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:05.718623+00:00", "ended_at": "2026-08-24T10:09:09.243587+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f19698f-dcc8-4aa4-a425-bcbef2bd6a1b", "name": "daring-seaward-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48944, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:01.093711+00:00", "ended_at": "2026-08-24T10:09:06.348230+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04fbd90f-00f9-447a-a6c7-a6de09dc95c0", "name": "hearty-coastal-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49494, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 189, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:09:00.830767+00:00", "ended_at": "2026-08-24T10:09:04.250401+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d1a85dbc-6d0b-4b73-93c8-305c883db6d3", "name": "upland-amber-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55608, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:46.994390+00:00", "ended_at": "2026-08-24T10:08:52.948015+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dadba46b-d2cb-4c7f-8f52-c2572d4a079f", "name": "graceful-reedy-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56440, "username": "zlm", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:42.284662+00:00", "ended_at": "2026-08-24T10:08:51.098245+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "db893203-ce41-451e-9c92-5daaf3df388e", "name": "northern-upland-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56456, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:41.716831+00:00", "ended_at": "2026-08-24T10:08:46.902847+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95f94d06-482a-4916-838b-3638e59a4a04", "name": "blunt-wistful-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54862, "username": "mysql", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:30.933771+00:00", "ended_at": "2026-08-24T10:08:34.701817+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "71ae1ad6-ad19-4864-adb7-b2ed06d85d9e", "name": "steady-jolly-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48582, "username": "fastuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:30.712021+00:00", "ended_at": "2026-08-24T10:08:38.100144+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "e14c3983-068c-448d-be1e-b3212df54a05", "name": "cunning-jovial-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48574, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:08.683674+00:00", "ended_at": "2026-08-24T10:08:12.495929+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "09567106-4011-468e-b9e4-f718382a7e5e", "name": "fleeting-granite-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60258, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:08:04.039670+00:00", "ended_at": "2026-08-24T10:08:09.507526+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6fa2e5b6-a812-4681-be47-ea1f81b9203a", "name": "regal-weathered-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48000, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:57.287056+00:00", "ended_at": "2026-08-24T10:08:00.932160+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cabe31de-832f-4bfb-8434-62358186c043", "name": "brazen-stoic-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47990, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:45.891588+00:00", "ended_at": "2026-08-24T10:07:50.113685+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "81613f96-5790-4c5a-b5e8-d361af532737", "name": "civil-frank-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59164, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:43.904829+00:00", "ended_at": "2026-08-24T10:07:47.540118+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7dbab3c6-5275-476e-8aa1-ed2e9886659c", "name": "civil-misty-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55784, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:38.236889+00:00", "ended_at": "2026-08-24T10:07:44.150386+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cbeddb1e-d2cf-4f20-950d-58dd963f04a0", "name": "lively-downy-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57496, "username": "ec2-user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:26.005306+00:00", "ended_at": "2026-08-24T10:07:29.710894+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0732711c-0323-4021-a06d-f454b7bc3309", "name": "electric-proud-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57450, "username": "adminuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:20.210916+00:00", "ended_at": "2026-08-24T10:07:25.938645+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "21469c68-e7f3-48c2-a7e2-5131d6251307", "name": "jaunty-mighty-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57570, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 471, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:10.526795+00:00", "ended_at": "2026-08-24T10:07:17.010397+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e1dc9b13-efe5-4b7f-a73e-f6f9bcaffb56", "name": "meadow-jaunty-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43250, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:05.923964+00:00", "ended_at": "2026-08-24T10:07:10.399105+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "044fde60-f493-44a2-a36b-e9a5f2146499", "name": "cunning-dutiful-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43226, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:07:03.630549+00:00", "ended_at": "2026-08-24T10:07:08.615490+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "92ec86e0-b815-420b-9b1f-6879f6e49a10", "name": "rustic-noble-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41144, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:51.151690+00:00", "ended_at": "2026-08-24T10:06:56.105294+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "83b82d3b-3797-4b1c-a7f1-c24f28644f3a", "name": "tangled-creaky-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55830, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:44.614027+00:00", "ended_at": "2026-08-24T10:06:50.006022+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5a28bcee-8584-4870-b89a-41d0d1de9800", "name": "sturdy-blunt-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48418, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:38.509083+00:00", "ended_at": "2026-08-24T10:06:41.726394+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ef0ac50-b472-4072-b4b9-68359278ddc9", "name": "quiet-emerald-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48410, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:34.112739+00:00", "ended_at": "2026-08-24T10:06:38.985415+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "795be882-cbf4-4f25-b1d5-0f646916f8ab", "name": "fearless-bitter-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33324, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:26.733663+00:00", "ended_at": "2026-08-24T10:06:31.102491+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6548eb9b-1021-410d-a3a6-80196ae78850", "name": "frank-hollow-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57776, "username": "openvpn", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:17.729436+00:00", "ended_at": "2026-08-24T10:06:23.521570+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78dba99c-85a6-4b68-8b5d-bfcb2e88d971", "name": "fleeting-dapper-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57780, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:14.412566+00:00", "ended_at": "2026-08-24T10:06:18.400165+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fd67a54b-9dde-4a6d-b60f-b7006b704495", "name": "hearty-snowy-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57828, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:06:01.601656+00:00", "ended_at": "2026-08-24T10:06:06.723180+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "63bc113b-1377-43e0-b56a-5f31cc40e5a6", "name": "humble-leafy-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43858, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:58.719477+00:00", "ended_at": "2026-08-24T10:06:01.945234+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f6058b3-20d1-4e7d-ae6b-95df74095cb6", "name": "lively-crystal-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33768, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:52.414578+00:00", "ended_at": "2026-08-24T10:05:56.450060+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "95a2ae12-d658-45c0-98d1-8f7ad9080a7e", "name": "tender-bitter-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43838, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:49.102399+00:00", "ended_at": "2026-08-24T10:05:53.338159+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "af1ee7ce-95c8-402c-b262-89ee040e225e", "name": "ancient-hidden-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33212, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:38.225696+00:00", "ended_at": "2026-08-24T10:05:41.448999+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "471cf1c5-b85f-42d8-8aaf-2233441b5582", "name": "lunar-sterling-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52594, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:26.017056+00:00", "ended_at": "2026-08-24T10:05:31.709195+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e5eaaec0-393b-4076-8738-170fdf2eab4c", "name": "kindly-stormy-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33196, "username": "angel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:25.128815+00:00", "ended_at": "2026-08-24T10:05:33.590759+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "69e9e875-7566-4c15-a461-459ade5ebfb5", "name": "leafy-feathered-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47334, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:15.233708+00:00", "ended_at": "2026-08-24T10:05:18.910051+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "130d6627-8b8e-485b-827c-cc214f6a328f", "name": "coastal-sunlit-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53120, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:05:06.522440+00:00", "ended_at": "2026-08-24T10:05:09.735901+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "df6fb641-94bc-417d-a81d-94a6b5cef9eb", "name": "nameless-watchful-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53108, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:55.112459+00:00", "ended_at": "2026-08-24T10:04:58.718110+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9dd64953-76b4-4b6e-a1a5-53f1e694e7e5", "name": "dusty-primal-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42340, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:48.500000+00:00", "ended_at": "2026-08-24T10:04:54.038013+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1169e8e1-5f50-4e6f-9901-5a25a49ad394", "name": "fabled-tawny-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52866, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:45.411500+00:00", "ended_at": "2026-08-24T10:04:48.203540+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d10729f-4347-4c85-891f-d3151a49afa5", "name": "placid-wistful-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:39.703536+00:00", "ended_at": "2026-08-24T10:04:44.395206+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "031120c9-45a4-45b8-ba69-cbcfcc1f661a", "name": "sooty-gleaming-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57314, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:37.413022+00:00", "ended_at": "2026-08-24T10:04:40.585880+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "28e17c0c-35b9-4f0f-9d7e-c055c1eca581", "name": "sooty-steady-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46344, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:30.281785+00:00", "ended_at": "2026-08-24T10:04:34.918949+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8fe29f59-8713-4962-9a10-c0491b0b089d", "name": "mighty-sullen-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53616, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:17.832351+00:00", "ended_at": "2026-08-24T10:04:21.114955+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1efe1fa2-22dc-4eaa-b0ce-3aeb315017c5", "name": "gilded-quartz-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53600, "username": "work", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:05.250184+00:00", "ended_at": "2026-08-24T10:04:09.045064+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bf3bf4c-d532-4ac6-b5bb-ed850eb292ab", "name": "earnest-crystal-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37210, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 241, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:04:05.191391+00:00", "ended_at": "2026-08-24T10:04:10.345910+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9fb5cda1-477c-4f1f-a7e5-b47c13b623d4", "name": "seaward-lunar-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60260, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:58.017359+00:00", "ended_at": "2026-08-24T10:04:03.302344+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eb8acfcb-b494-4719-9112-964c28857153", "name": "peaty-regal-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46116, "username": "kipt", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:56.122657+00:00", "ended_at": "2026-08-24T10:04:03.613045+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "3aabc2cc-34d2-4871-bc03-f65218f0713f", "name": "plush-glacial-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60236, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:53.621872+00:00", "ended_at": "2026-08-24T10:03:59.621770+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "937c6159-30a4-479f-adda-7df8fdaee1c6", "name": "spirited-courtly-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45290, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:36.924003+00:00", "ended_at": "2026-08-24T10:03:41.192750+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "459ab14c-d7b5-4929-9a09-8d6f053a918b", "name": "ginger-regal-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45282, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:29.216343+00:00", "ended_at": "2026-08-24T10:03:35.314755+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "55063d83-6a15-44dc-9822-611e0a8bc703", "name": "meadow-tidal-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58240, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:18.422955+00:00", "ended_at": "2026-08-24T10:03:23.206184+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "27698e58-0d0e-444b-936f-750307e195a6", "name": "glassy-boreal-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59080, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:14.695266+00:00", "ended_at": "2026-08-24T10:03:18.186828+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3f128702-9ffc-4a3c-af60-85c24458b13e", "name": "kindly-fickle-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59086, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:14.292529+00:00", "ended_at": "2026-08-24T10:03:19.956377+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b1969741-b0ff-43ff-86de-d5ee8466a9c9", "name": "watchful-nameless-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54652, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:03:05.332240+00:00", "ended_at": "2026-08-24T10:03:11.014251+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ecb2d5b2-b990-44f6-b4d5-b48683ab91db", "name": "fringed-dusty-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42822, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:56.526583+00:00", "ended_at": "2026-08-24T10:02:59.906556+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f0a41ab0-37f9-456b-91f1-e4b1e7a48a67", "name": "mindful-russet-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33254, "username": "wang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:47.621255+00:00", "ended_at": "2026-08-24T10:02:55.515436+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "bf55de40-eb5a-4e25-9ee0-3d8a9d036938", "name": "mighty-woven-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33268, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:43.619712+00:00", "ended_at": "2026-08-24T10:02:49.314237+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6f458b5c-3a80-46cd-a6d3-eff8999404f1", "name": "curious-tidal-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60040, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:32.307427+00:00", "ended_at": "2026-08-24T10:02:37.301720+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a249367b-6136-41bd-9c95-2e86313cdb5a", "name": "peaty-nameless-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53164, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:27.106773+00:00", "ended_at": "2026-08-24T10:02:30.443758+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6cb9b10f-0d76-4f5e-b2c1-5ec7b72d8290", "name": "early-woven-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46658, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:20.621678+00:00", "ended_at": "2026-08-24T10:02:26.303010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31572acb-d73f-455b-a51f-23a845dec251", "name": "wry-drifting-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36940, "username": "orange", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:12.301290+00:00", "ended_at": "2026-08-24T10:02:20.129303+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c8663c53-e3c7-4406-9643-f5f0e083825a", "name": "drifting-obsidian-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46634, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:09.509650+00:00", "ended_at": "2026-08-24T10:02:13.019967+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "269351fd-ee2a-49d0-9b32-ed6c227d5ae2", "name": "brave-whispering-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40954, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:02:00.112748+00:00", "ended_at": "2026-08-24T10:02:05.244065+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fb614208-b6c5-47b2-ae8d-5b12d3754a8f", "name": "sterling-twilight-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40950, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:53.202536+00:00", "ended_at": "2026-08-24T10:01:59.246888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c56ed98a-cd39-42be-8c2a-38ddff19c1fc", "name": "sooty-brazen-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59336, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:40.491412+00:00", "ended_at": "2026-08-24T10:01:46.206389+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "932b9674-f5e3-46a2-9f38-ac6365300339", "name": "idle-snowy-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40370, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:39.708826+00:00", "ended_at": "2026-08-24T10:01:43.228667+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f822f9e7-75ac-48e2-9062-4f4738096b03", "name": "placid-curious-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59322, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:32.092268+00:00", "ended_at": "2026-08-24T10:01:37.826588+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3133908f-d2db-4faf-bfae-5657d9da25d8", "name": "feral-deft-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38842, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:24.905106+00:00", "ended_at": "2026-08-24T10:01:28.490216+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c32f940-8fc3-41a5-a119-903a4441c3e9", "name": "subtle-courtly-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51994, "username": "codex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 220, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:16.008420+00:00", "ended_at": "2026-08-24T10:01:20.792300+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "a5c795cc-72df-4f9d-9591-22e0d463a58d", "name": "lucid-eager-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51996, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:01:13.344273+00:00", "ended_at": "2026-08-24T10:01:18.432397+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8a1bf508-2be3-47dc-9ead-3501501836db", "name": "whispering-fleeting-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37784, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:59.325968+00:00", "ended_at": "2026-08-24T10:01:02.330115+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ed7d516-d627-4241-af9d-f7b56c2dc2f7", "name": "valiant-pristine-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57408, "username": "nutanix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:57.430730+00:00", "ended_at": "2026-08-24T10:01:04.326387+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "d8b7d6b7-99e7-4ad1-b5d3-4b8a89ec429c", "name": "cosmic-deft-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60462, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:55.031553+00:00", "ended_at": "2026-08-24T10:00:59.404267+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e21fbe85-abef-4177-a5e0-eb2c6cce0569", "name": "canny-loyal-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57390, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:40.027890+00:00", "ended_at": "2026-08-24T10:00:44.019417+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b1fe3580-06ec-4506-9382-0f58c0f67874", "name": "spirited-emerald-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49810, "username": "trader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:28.601556+00:00", "ended_at": "2026-08-24T10:00:31.698492+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b7adda4-ed6f-4206-b3fb-1e4a44d69a08", "name": "grumpy-autumn-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40660, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:19.510787+00:00", "ended_at": "2026-08-24T10:00:22.538187+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a20cebde-98f3-4d31-ac43-706babbba6b8", "name": "muted-eager-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40648, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:17.422833+00:00", "ended_at": "2026-08-24T10:00:22.508486+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f9f2cc84-8a40-473a-9eee-17b5da20efc4", "name": "mellow-woven-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36852, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:07.826487+00:00", "ended_at": "2026-08-24T10:00:13.022202+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c97a994b-6f3b-4dc3-9c04-b64d9527145b", "name": "airy-leafy-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44842, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T10:00:07.444203+00:00", "ended_at": "2026-08-24T10:00:13.585430+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4c6e64a-111b-45c1-a492-8d7081a71634", "name": "blithe-scarlet-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40386, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:58.400555+00:00", "ended_at": "2026-08-24T10:00:01.406060+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "feb6d8e2-eb2b-48cd-bdd6-599265edb413", "name": "weathered-sandy-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60290, "username": "clawdbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:49.684697+00:00", "ended_at": "2026-08-24T09:59:55.634556+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "8e0c7702-ad74-4343-8783-ab7bce8806d3", "name": "woven-forlorn-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40380, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:47.119470+00:00", "ended_at": "2026-08-24T09:59:51.735515+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9b4d8cb-d80f-429f-9d10-28e85bb45b38", "name": "buoyant-electric-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53174, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:45.285670+00:00", "ended_at": "2026-08-24T09:59:50.328175+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3a485e24-bd18-48c2-b4da-f85e016c8f09", "name": "gallant-wooded-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60288, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:32.207479+00:00", "ended_at": "2026-08-24T09:59:37.038615+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1cc6b377-551f-414b-b6b2-1b6a8b04a2ad", "name": "vernal-bashful-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55012, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:30.193893+00:00", "ended_at": "2026-08-24T09:59:36.178366+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "07a2f52d-099c-41eb-b88b-290d635ffd2d", "name": "eager-somber-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57562, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:15.437129+00:00", "ended_at": "2026-08-24T09:59:20.015657+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4f778f2d-f4f2-4813-b9d9-7564a4c6f028", "name": "blunt-hollow-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40524, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:10.435239+00:00", "ended_at": "2026-08-24T09:59:15.296182+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "de257bc3-45aa-4594-9ef8-c006804f63b8", "name": "umber-watchful-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34940, "username": "doris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:05.837489+00:00", "ended_at": "2026-08-24T09:59:14.414286+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "0c13656b-2b65-4944-95d6-a5813764cdac", "name": "eager-jagged-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57554, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:59:01.587714+00:00", "ended_at": "2026-08-24T09:59:07.510842+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a47593ba-668d-43ae-bea4-c795ca1931bf", "name": "chilly-vigilant-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36952, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:48.603782+00:00", "ended_at": "2026-08-24T09:58:52.394636+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7634024-4af3-4a02-803e-048220b8643f", "name": "verdant-reedy-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36948, "username": "amin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:39.194184+00:00", "ended_at": "2026-08-24T09:58:43.398134+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f572ba5c-3e16-407e-b82e-3a9130e3a2d6", "name": "nameless-airy-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59508, "username": "gpadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:33.338699+00:00", "ended_at": "2026-08-24T09:58:40.731331+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "756ef4a7-1b50-4dd2-b3e9-94b4dc1ab615", "name": "emerald-stoic-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53866, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:32.809046+00:00", "ended_at": "2026-08-24T09:58:37.892630+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9461c001-cb82-40a1-bd09-718dee7220bb", "name": "amber-twilight-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42856, "username": "devops", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:18.583664+00:00", "ended_at": "2026-08-24T09:58:24.445789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4840c051-a0c0-42c7-91b2-f06dab6b3ccd", "name": "cheerful-gleaming-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57096, "username": "esuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:14.815821+00:00", "ended_at": "2026-08-24T09:58:22.016670+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "92779bc3-8334-454b-acf6-2038799b90cc", "name": "languid-jaunty-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42848, "username": "worker", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:58:13.020657+00:00", "ended_at": "2026-08-24T09:58:16.106076+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "888cf3ce-59f0-45b1-be20-61139a8003e0", "name": "alpine-stoic-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47846, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:57.599745+00:00", "ended_at": "2026-08-24T09:58:00.691907+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b9b7e7f3-07b5-4a43-9afc-dd6779dea5a6", "name": "tranquil-feathered-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47824, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:52.615744+00:00", "ended_at": "2026-08-24T09:57:56.914132+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4ecbb5d4-df74-4778-b38c-40bed870f263", "name": "frosty-gnarled-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60806, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:45.722005+00:00", "ended_at": "2026-08-24T09:57:49.223075+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0d818df2-a38e-49c9-a400-413cb760e1a5", "name": "earnest-gloomy-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42836, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 276, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:30.328715+00:00", "ended_at": "2026-08-24T09:57:35.613433+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ecf77b3c-0551-4ec3-bf63-1d74e1e7eb2f", "name": "orderly-serene-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43634, "username": "t1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:26.694687+00:00", "ended_at": "2026-08-24T09:57:33.505658+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "4b1f005b-b520-4bda-8930-31986d986ba9", "name": "solar-snowy-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43648, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 277, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:26.429378+00:00", "ended_at": "2026-08-24T09:57:31.295124+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0346b892-410c-4687-8896-52d92bbbfde6", "name": "silent-hearty-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33828, "username": "nvidia", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:25.421683+00:00", "ended_at": "2026-08-24T09:57:31.398357+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "5d644c1f-3d9d-4c68-945c-2d4804e0ee3d", "name": "frank-pristine-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56000, "username": "vyos", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:16.882309+00:00", "ended_at": "2026-08-24T09:57:22.106015+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "006ed28a-5d5e-4fe8-8da4-bf6641837a0b", "name": "freckled-thrifty-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56022, "username": "chris", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:57:09.227244+00:00", "ended_at": "2026-08-24T09:57:14.899859+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9ec6f802-6285-44ee-8f51-6bf4657b2dc3", "name": "alpine-arctic-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55484, "username": "jack", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:57.203246+00:00", "ended_at": "2026-08-24T09:57:04.495746+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "4deb55eb-3bfe-44b4-9e74-14e6ac338563", "name": "tender-ivory-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34702, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:56.310938+00:00", "ended_at": "2026-08-24T09:56:59.851182+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8f5651a-f609-4bff-b609-12f83ef13824", "name": "sooty-civil-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55456, "username": "rocky", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:50.117393+00:00", "ended_at": "2026-08-24T09:56:58.495511+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "a8b0941d-55fb-4442-8fda-041868b60910", "name": "dusty-restless-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37868, "username": "test3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:43.714047+00:00", "ended_at": "2026-08-24T09:56:50.030150+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1654 }, { "id": "9aedf050-b982-4ed8-91e8-b10e579741c6", "name": "brave-brazen-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35858, "username": "dspace", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:42.744711+00:00", "ended_at": "2026-08-24T09:56:48.820043+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7021c3d7-ef43-4172-89fe-8162723f1088", "name": "murky-burly-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44002, "username": "default", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:23.087811+00:00", "ended_at": "2026-08-24T09:56:29.411223+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "f5fc6621-63b1-4d6d-8c5c-758e90dfe839", "name": "nautical-upland-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37844, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:17.638277+00:00", "ended_at": "2026-08-24T09:56:21.945465+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2222ab15-e7b7-4ccf-a945-125d70dd344d", "name": "silent-rapid-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41278, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:56:01.395699+00:00", "ended_at": "2026-08-24T09:56:04.104032+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "418f9abf-3bfb-4c43-abdc-b1215772b3e8", "name": "balmy-vivid-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45326, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 253, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:56.422003+00:00", "ended_at": "2026-08-24T09:56:02.040582+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6108caeb-8401-481f-bdd5-e3e4e450f4fa", "name": "lanky-sincere-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60464, "username": "data", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:53.605455+00:00", "ended_at": "2026-08-24T09:55:59.824789+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "ca0d2ac8-4b93-4238-ba2a-9c442853be50", "name": "gnarled-dapper-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45320, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:50.337889+00:00", "ended_at": "2026-08-24T09:55:53.516070+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8b079499-3036-417b-a0dd-198ab18eb224", "name": "upland-earnest-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57450, "username": "drcomadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:40.311521+00:00", "ended_at": "2026-08-24T09:55:47.385982+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "14deccf8-600a-4da9-b024-2995a32430a5", "name": "quartz-feathered-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57460, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 184, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:34.529299+00:00", "ended_at": "2026-08-24T09:55:40.085330+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eeb988d7-2e28-4732-bdd2-364f88e6c21e", "name": "hushed-mossy-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40390, "username": "lighthouse", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:28.695593+00:00", "ended_at": "2026-08-24T09:55:35.420383+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "5a0634c3-41fb-47ef-8d44-81e220b9ceee", "name": "vernal-indigo-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47552, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 203, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:13.358566+00:00", "ended_at": "2026-08-24T09:55:18.526704+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "de7c613b-d694-4d5e-8628-33bf34483bfb", "name": "ashen-polar-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47544, "username": "airflow", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:11.745847+00:00", "ended_at": "2026-08-24T09:55:17.407286+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "0647f29e-9d1e-4152-bb9c-003aa36b809b", "name": "dusty-fabled-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60532, "username": "student", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:55:10.898714+00:00", "ended_at": "2026-08-24T09:55:16.539796+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "df141d71-b7d0-48bd-9631-b89c75a8c9b3", "name": "bitter-tawny-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40430, "username": "developer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:58.948203+00:00", "ended_at": "2026-08-24T09:55:03.814432+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "698ad366-8367-4157-8480-d355ce8766a4", "name": "supple-plush-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42888, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:50.292829+00:00", "ended_at": "2026-08-24T09:54:55.337757+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1f5e178b-ee7f-411c-9991-3eee99991078", "name": "watchful-ginger-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42850, "username": "hamed", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 227, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:44.908678+00:00", "ended_at": "2026-08-24T09:54:53.284131+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "14b9246d-5e26-4172-93b5-922c023e3416", "name": "gentle-freckled-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38798, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:30.202581+00:00", "ended_at": "2026-08-24T09:54:34.486888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5f957f39-4ae5-4d7c-9a3a-db57628366fd", "name": "calm-downy-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37750, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:23.601903+00:00", "ended_at": "2026-08-24T09:54:26.817287+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "31bab0bb-e73b-4d49-a045-581e107ba9fe", "name": "sturdy-murky-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35816, "username": "lucas", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:21.686653+00:00", "ended_at": "2026-08-24T09:54:30.596285+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "87c962b3-68e3-48a5-b589-5a5517694272", "name": "plucky-cunning-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37718, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 180, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:19.889775+00:00", "ended_at": "2026-08-24T09:54:25.243962+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "90954fbc-f78d-4a99-bbc8-f82443b9b6fc", "name": "brazen-feral-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37980, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:09.912749+00:00", "ended_at": "2026-08-24T09:54:15.917336+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7e940b28-beb2-48d8-b28a-bc23682b151c", "name": "civil-fearless-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37972, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:54:00.681334+00:00", "ended_at": "2026-08-24T09:54:06.093783+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa1ed652-69ce-4e07-afcc-f80f50fde8f3", "name": "subtle-northern-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41456, "username": "ark", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:51.005958+00:00", "ended_at": "2026-08-24T09:53:57.736069+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "242cb24d-5c29-4d16-8e49-cbbaed55fd3b", "name": "electric-mellow-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47040, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:47.392193+00:00", "ended_at": "2026-08-24T09:53:52.886943+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cb1d534b-d8db-4463-ae78-fcb0e8136a3e", "name": "sturdy-ancient-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56848, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:38.492601+00:00", "ended_at": "2026-08-24T09:53:44.428388+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "44e5bbe8-b1aa-4475-a273-994785e81727", "name": "lonesome-ashen-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56818, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:36.579598+00:00", "ended_at": "2026-08-24T09:53:41.686964+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f63d02c3-0c8a-4d7c-a152-73f58235952a", "name": "amber-sooty-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44768, "username": "grid", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:30.626018+00:00", "ended_at": "2026-08-24T09:53:37.008113+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "f51cbf19-5a8e-4e80-a29a-07da7f71004a", "name": "rugged-dusky-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56474, "username": "hduser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:27.896263+00:00", "ended_at": "2026-08-24T09:53:36.626854+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7c1fc0d8-483f-4c21-9828-fa71f65e727c", "name": "cosmic-vivid-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44758, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:09.234872+00:00", "ended_at": "2026-08-24T09:53:13.431930+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "260faea7-b05c-4ea0-8018-ff4e23407e43", "name": "brave-creaky-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52752, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:02.342327+00:00", "ended_at": "2026-08-24T09:53:06.685380+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "88275edb-2f6d-40e5-a01d-edb9ed843db2", "name": "weathered-smooth-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42050, "username": "aiuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:53:00.718703+00:00", "ended_at": "2026-08-24T09:53:06.309199+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "d0202b5a-d411-40e9-85a5-e9747c5434ba", "name": "buoyant-stormy-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42066, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:58.241243+00:00", "ended_at": "2026-08-24T09:53:03.319007+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5b870459-dfe9-4924-ac77-7e0552676346", "name": "salty-stormy-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40888, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:39.510499+00:00", "ended_at": "2026-08-24T09:52:42.680368+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "db011fc0-a958-4d91-b409-5ffef18bc748", "name": "crisp-nameless-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46202, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:38.696010+00:00", "ended_at": "2026-08-24T09:52:43.232681+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5751e005-8a45-4a60-aae9-009e0d6fea08", "name": "woven-blunt-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40886, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:31.396706+00:00", "ended_at": "2026-08-24T09:52:34.851204+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3d31e890-5f20-4bb4-a306-dfb1870fbbb0", "name": "sullen-freckled-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59660, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:21.900713+00:00", "ended_at": "2026-08-24T09:52:27.360138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a8102d99-39a5-4031-b4f7-b8ef68c68a6d", "name": "smoky-fleeting-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52082, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:11.553850+00:00", "ended_at": "2026-08-24T09:52:16.616262+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0aae96e3-08e7-4881-9558-4da879c51a40", "name": "deft-salty-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35282, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:11.190213+00:00", "ended_at": "2026-08-24T09:52:14.246826+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f22e2781-dded-4bb0-86cf-728bf1c74649", "name": "nimble-emerald-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46714, "username": "gitlab-runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:03.724653+00:00", "ended_at": "2026-08-24T09:52:12.547780+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1666 }, { "id": "3315c4e9-12e9-4f27-9f38-b77d6c3ded2b", "name": "freckled-misty-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35266, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:52:00.434308+00:00", "ended_at": "2026-08-24T09:52:03.381162+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "15ea2a08-dbd9-44a2-af4d-bcca5ad94244", "name": "buoyant-fabled-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51130, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:46.347348+00:00", "ended_at": "2026-08-24T09:51:51.110449+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "842076de-67d7-4f31-b809-2302923bdd7e", "name": "jagged-lively-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51114, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:39.031041+00:00", "ended_at": "2026-08-24T09:51:44.338763+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2f7d2e42-4a22-4195-a50d-4fc4940a54c7", "name": "freckled-hazy-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56544, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 227, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:32.993120+00:00", "ended_at": "2026-08-24T09:51:37.217151+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0aa366bd-d212-40e1-afc6-c7bfcb1743d5", "name": "painted-downy-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34936, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:23.893832+00:00", "ended_at": "2026-08-24T09:51:26.892260+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "529aeb40-d792-4ad2-8cb0-30bfa4adbea6", "name": "seaward-vivid-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34922, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:13.291040+00:00", "ended_at": "2026-08-24T09:51:19.301228+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c3fe5c42-544b-4b81-ae99-9def7c8ad3d2", "name": "murky-mottled-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50648, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:10.446144+00:00", "ended_at": "2026-08-24T09:51:16.546237+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "286396b1-6e12-4d35-ae2c-b44dd4cad999", "name": "seaward-scarlet-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41328, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:09.781361+00:00", "ended_at": "2026-08-24T09:51:13.914590+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "099bf3ef-863b-456e-852a-1bef42096563", "name": "granite-vaulted-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40966, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:51:01.623995+00:00", "ended_at": "2026-08-24T09:51:05.608576+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0cfd648-4cef-458e-be98-558bb6ac46d2", "name": "peaty-frank-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40952, "username": "joel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:54.497348+00:00", "ended_at": "2026-08-24T09:51:00.825318+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "71a9affb-8d19-4831-a7bb-bc41108351f4", "name": "salty-chilly-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38410, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:45.933732+00:00", "ended_at": "2026-08-24T09:50:50.413138+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e00deea8-5a4f-49aa-b03d-8be6c4d2dd36", "name": "eager-bitter-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49462, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:33.508391+00:00", "ended_at": "2026-08-24T09:50:39.511538+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5d9aac6b-2faa-4814-9c26-dffc6ab3243a", "name": "early-somber-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49446, "username": "elastic", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:29.989654+00:00", "ended_at": "2026-08-24T09:50:34.317373+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47567079-5f64-450b-948f-7e6859a6adde", "name": "dapper-gnarled-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43508, "username": "elasticsearch", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 210, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:20.927267+00:00", "ended_at": "2026-08-24T09:50:25.388726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dcce202d-1ef7-48ff-9544-84a403241da9", "name": "vivid-shaded-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46806, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:16.018437+00:00", "ended_at": "2026-08-24T09:50:18.939192+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d330b0aa-ffca-47a9-9ac5-b760b9eb75c0", "name": "breezy-wandering-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39130, "username": "splunk", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:10.729370+00:00", "ended_at": "2026-08-24T09:50:17.901358+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "665a5ecc-7195-4aa7-8090-59cd409740ca", "name": "bashful-leafy-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39136, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:50:06.615904+00:00", "ended_at": "2026-08-24T09:50:10.437177+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1ee9387f-939c-4058-abbb-588481928d45", "name": "restless-verdant-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59836, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:56.119953+00:00", "ended_at": "2026-08-24T09:49:59.095438+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ea72bd1a-ae1e-4df3-92c4-911eb8fadb52", "name": "somber-nameless-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45842, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:50.535586+00:00", "ended_at": "2026-08-24T09:49:56.013193+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41b3de5f-b8a6-4282-9b4b-d6d9f649418b", "name": "courtly-creaky-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45836, "username": "debian", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:42.909124+00:00", "ended_at": "2026-08-24T09:49:47.026143+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "58804277-ef22-4ec4-add0-20ba6d6adb74", "name": "bronzed-kindly-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48414, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:33.823599+00:00", "ended_at": "2026-08-24T09:49:37.737171+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cb40cbe0-dc3a-479e-991f-6cbb356e6d0c", "name": "autumn-crystal-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53640, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:22.896182+00:00", "ended_at": "2026-08-24T09:49:27.983092+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f117ca37-c613-47c1-983e-78c550d3d4d7", "name": "smooth-sullen-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47184, "username": "botuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:22.894165+00:00", "ended_at": "2026-08-24T09:49:30.907757+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "abab4f70-c0fc-4cc2-96b5-e309bb4fbf47", "name": "dewy-misty-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53624, "username": "ftp", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:17.303726+00:00", "ended_at": "2026-08-24T09:49:20.933141+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "57c5c0b8-a7e7-43fc-94e9-1fecb5e84f9c", "name": "breezy-seaward-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46408, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:05.701432+00:00", "ended_at": "2026-08-24T09:49:09.816216+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "01868280-5f24-473c-aab6-cf96c24a402f", "name": "vaulted-mossy-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38694, "username": "jenkins", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:49:01.007865+00:00", "ended_at": "2026-08-24T09:49:07.357013+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "2544f668-afb2-4dfd-b03c-cd1ce4dc7a80", "name": "tranquil-stoic-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38700, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 209, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:59.726285+00:00", "ended_at": "2026-08-24T09:49:04.292726+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8359dac2-ed2e-4249-ac16-9e37dda8ee8c", "name": "plucky-emerald-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52904, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:44.611287+00:00", "ended_at": "2026-08-24T09:48:49.649404+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2251dd8-ab1d-4153-a3e3-ce9ebdab7349", "name": "ancient-tidal-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58552, "username": "mohammad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:43.545691+00:00", "ended_at": "2026-08-24T09:48:51.298735+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "6ebe646d-a12e-426c-8cd9-2aa705491084", "name": "peaty-graceful-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58544, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:33.493669+00:00", "ended_at": "2026-08-24T09:48:37.284964+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "379b9bdf-eea8-4b39-9f1d-3f15e05e0f49", "name": "wiry-snowy-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50386, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:21.290562+00:00", "ended_at": "2026-08-24T09:48:24.896439+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "508bfc9f-869d-49c0-acd7-41e2c551acdb", "name": "orderly-glassy-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43654, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 220, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:14.323923+00:00", "ended_at": "2026-08-24T09:48:20.003546+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0461fb0b-ec7e-4461-8d5f-4223fa0331df", "name": "rustic-balmy-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56962, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:13.125458+00:00", "ended_at": "2026-08-24T09:48:19.226679+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "86024a64-f081-4ab6-846f-b81cffaa3477", "name": "deft-vernal-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51852, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:48:03.926809+00:00", "ended_at": "2026-08-24T09:48:08.689379+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f13d7296-1ca6-41bb-b4e6-ffa874d4b483", "name": "orderly-grassy-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51840, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:51.702828+00:00", "ended_at": "2026-08-24T09:47:56.004374+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "38b03370-b476-4f15-b40a-f2f68188f7ec", "name": "fickle-gloomy-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35552, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 256, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:50.701596+00:00", "ended_at": "2026-08-24T09:47:56.585721+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "57ac8854-4a93-4ee5-8e88-e01f38d26ce7", "name": "blazing-courtly-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36410, "username": "gitlab", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:38.523590+00:00", "ended_at": "2026-08-24T09:47:41.518764+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1bf08f89-7fd6-4ec6-b40d-34498a3c0c14", "name": "cunning-rustic-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41416, "username": "jakob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:32.642815+00:00", "ended_at": "2026-08-24T09:47:38.396565+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "d599850c-c391-4a73-b1c0-3ccd6ba0c471", "name": "gnarled-misty-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36406, "username": "minecraft", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:28.387396+00:00", "ended_at": "2026-08-24T09:47:32.707903+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c99cc1ac-518d-41e7-b29d-da93b7c2f2f1", "name": "jaunty-thawing-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46808, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 388, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:16.345069+00:00", "ended_at": "2026-08-24T09:47:20.943594+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4fc1d680-7262-453e-b626-790d340b7cc0", "name": "airy-mottled-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57590, "username": "testuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 255, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:11.614953+00:00", "ended_at": "2026-08-24T09:47:20.604793+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "8da8541a-880e-436a-9671-0670b18d2b81", "name": "faded-thawing-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57584, "username": "dolphinscheduler", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:47:07.006231+00:00", "ended_at": "2026-08-24T09:47:15.376367+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1669 }, { "id": "24449a77-07ad-4a87-8167-2d4a3d6ef02f", "name": "lanky-distant-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54528, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:53.805349+00:00", "ended_at": "2026-08-24T09:46:59.411664+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "846a6828-c693-40ff-8992-ab3a53862ef4", "name": "fickle-amiable-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37552, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:49.624040+00:00", "ended_at": "2026-08-24T09:46:55.125462+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c2ced84f-18a3-42ad-b267-3d54fb0bcc03", "name": "sturdy-drifting-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54592, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:37.244949+00:00", "ended_at": "2026-08-24T09:46:42.617012+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "027a7b2a-75b5-43c4-9e92-0c95f1b179fa", "name": "breezy-nautical-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54580, "username": "a", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:32.911337+00:00", "ended_at": "2026-08-24T09:46:36.246914+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6447b85f-665d-46e4-a466-71787c116c3f", "name": "fabled-kindly-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40864, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:20.795305+00:00", "ended_at": "2026-08-24T09:46:23.794781+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "53ddb0b1-627b-4a9e-a598-32f33029f1a5", "name": "western-stoic-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58922, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:17.203280+00:00", "ended_at": "2026-08-24T09:46:21.117671+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "67ee21af-03af-40af-9d90-891184c2b3e4", "name": "languid-sullen-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58912, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:05.129006+00:00", "ended_at": "2026-08-24T09:46:09.309940+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c0fa3514-f99a-448e-8e7a-3eb2d9069aa0", "name": "fleeting-hardy-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59992, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 227, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:46:01.902441+00:00", "ended_at": "2026-08-24T09:46:05.913763+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "38248df2-4caf-4c15-b0d3-4bc7b7a8974f", "name": "electric-woven-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50224, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:54.623097+00:00", "ended_at": "2026-08-24T09:46:00.326568+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0ac6adc0-74c5-4d8b-812e-41fd3cbdbd2c", "name": "buoyant-russet-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52190, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:50.700380+00:00", "ended_at": "2026-08-24T09:45:55.597003+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cc555cea-d987-4a79-9b5b-fc44582382de", "name": "proud-bronzed-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34820, "username": "user10", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:46.634670+00:00", "ended_at": "2026-08-24T09:45:54.195312+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c00383f2-9882-4220-9c79-8e474b7d2aa9", "name": "jovial-feral-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52174, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 394, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:40.494602+00:00", "ended_at": "2026-08-24T09:45:45.428678+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0441b4ab-2930-4f22-8483-1c1805111654", "name": "mindful-rugged-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40136, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:25.596034+00:00", "ended_at": "2026-08-24T09:45:29.029047+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "41545e18-e33e-41e7-830d-1a2a7b8ccbed", "name": "gallant-bitter-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42546, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:22.678212+00:00", "ended_at": "2026-08-24T09:45:27.107627+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f1f12e51-db02-4276-9578-366d0eb7daff", "name": "meadow-mindful-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42530, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:09.406097+00:00", "ended_at": "2026-08-24T09:45:12.823383+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ccb50c53-0280-4e93-9bbf-54a265f98cdf", "name": "dewy-salty-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34028, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 248, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:05.502678+00:00", "ended_at": "2026-08-24T09:45:11.097966+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a064aaa4-79d5-4695-beb9-bb5546e4d3a7", "name": "sandy-merry-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47244, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:45:03.231457+00:00", "ended_at": "2026-08-24T09:45:07.112840+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7034fc14-bb96-4a1d-ba22-ccbe22fa6800", "name": "wistful-icy-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37152, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:50.684896+00:00", "ended_at": "2026-08-24T09:44:53.809191+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4067ce6-2865-45ba-90a9-eb2d91cb065d", "name": "northern-feral-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51122, "username": "aaa", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:46.186539+00:00", "ended_at": "2026-08-24T09:44:51.317865+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "9d9b1fd3-859d-4b3b-bb7a-9296daf57aab", "name": "lucid-ancient-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37138, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:43.124489+00:00", "ended_at": "2026-08-24T09:44:48.923766+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "20d77422-3907-4d7a-8f2e-27ba7b9369b5", "name": "gallant-electric-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44324, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:31.023298+00:00", "ended_at": "2026-08-24T09:44:33.855040+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "13718ab5-98d6-411d-b6df-1ff0ca7640f2", "name": "lawful-verdant-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44286, "username": "alex", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:18.922457+00:00", "ended_at": "2026-08-24T09:44:23.630565+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4bc20a7b-85fc-4bf3-9cb2-d0600b3e54f2", "name": "dusky-gallant-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53614, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:14.613376+00:00", "ended_at": "2026-08-24T09:44:19.284291+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "38e72ede-0822-4425-b4a0-04c22c2136c6", "name": "electric-fickle-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55652, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:11.910995+00:00", "ended_at": "2026-08-24T09:44:16.785221+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a77128b8-82b9-4f36-80a0-a205b9dee57f", "name": "painted-sincere-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47110, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 281, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:44:00.643968+00:00", "ended_at": "2026-08-24T09:44:03.436290+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8325b7eb-0ef6-49ce-a28d-4bd84582e6fd", "name": "lunar-nautical-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47098, "username": "rancher", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:53.818619+00:00", "ended_at": "2026-08-24T09:44:00.848921+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "753d98ef-22e1-40ce-b3a3-98423e13774d", "name": "autumn-western-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34744, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:40.313141+00:00", "ended_at": "2026-08-24T09:43:45.246055+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b626ac86-02cb-471d-91cd-2a9fbd391494", "name": "dewy-granite-woodchuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38122, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:39.947410+00:00", "ended_at": "2026-08-24T09:43:45.301294+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b8c0385a-1473-4c30-96c4-bc36d7b62bbb", "name": "vigilant-windswept-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51728, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:27.732183+00:00", "ended_at": "2026-08-24T09:43:33.650129+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04a451e2-5a9c-4eb2-a12e-318a735e7291", "name": "marbled-hollow-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51714, "username": "milad", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:26.636288+00:00", "ended_at": "2026-08-24T09:43:33.427261+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "e7066e68-1a8f-4384-8afa-c9cc0e5d7eeb", "name": "quiet-mindful-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38092, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:18.114495+00:00", "ended_at": "2026-08-24T09:43:22.904661+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "47d3f46a-a009-4eaf-acad-6b1411280049", "name": "restless-ruddy-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49696, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:10.432639+00:00", "ended_at": "2026-08-24T09:43:15.117836+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a604178d-0511-45f2-9ef0-2f022e56f885", "name": "coral-thrifty-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34260, "username": "recorder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:43:09.931378+00:00", "ended_at": "2026-08-24T09:43:18.582829+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "fc89364e-4653-4194-9848-0a9ba4dd6f98", "name": "gritty-dusky-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59034, "username": "david", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:50.785402+00:00", "ended_at": "2026-08-24T09:42:58.695125+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "8d3bd6ed-c0bc-4a2a-9fab-2565680307f4", "name": "gentle-rugged-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34256, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 245, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:49.537622+00:00", "ended_at": "2026-08-24T09:42:53.790910+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3bff0058-6311-4b62-a431-787a7d9f1243", "name": "chilly-smoky-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34076, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:38.087621+00:00", "ended_at": "2026-08-24T09:42:43.899734+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "67831fa7-f458-4bd2-8950-038a0cabf207", "name": "crystal-woven-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42560, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:26.085494+00:00", "ended_at": "2026-08-24T09:42:30.105916+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "81b0be3a-24d8-4ed3-9bdd-3dae4d903277", "name": "vernal-dusty-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42552, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:20.308547+00:00", "ended_at": "2026-08-24T09:42:25.307170+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "445ffbe9-5815-4642-9935-07dd672038ab", "name": "patient-fierce-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46750, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:16.149347+00:00", "ended_at": "2026-08-24T09:42:22.115938+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f43cc187-3a9b-4eda-8bec-0fb0773caa94", "name": "gnarled-drifting-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35484, "username": "odoo14", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:11.441110+00:00", "ended_at": "2026-08-24T09:42:19.342045+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "ed34bbb5-6387-4f0b-97ff-0ff60f41e7d9", "name": "fickle-loyal-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35474, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:42:02.012836+00:00", "ended_at": "2026-08-24T09:42:07.184083+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f5101b6e-9502-4e5c-adb6-c939292e72b5", "name": "serene-marine-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59846, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:53.986825+00:00", "ended_at": "2026-08-24T09:41:56.842186+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a6902340-c759-4701-85d3-f8f047cd876b", "name": "pleasant-tawny-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59798, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:37.351149+00:00", "ended_at": "2026-08-24T09:41:42.225646+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ee1cce53-7cdf-470e-b128-a23c8db3dc2b", "name": "ginger-western-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51694, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:35.901187+00:00", "ended_at": "2026-08-24T09:41:40.533125+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fa5143f6-60c5-46ff-bb25-1353bb50e471", "name": "lunar-nimble-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59784, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:32.727438+00:00", "ended_at": "2026-08-24T09:41:36.027981+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "330fcbbb-5a47-454b-9156-56cd8be0957c", "name": "jagged-canny-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57488, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:22.388108+00:00", "ended_at": "2026-08-24T09:41:27.329694+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "120e0897-8f89-4bbe-8caa-ce9a117e299d", "name": "genial-sunlit-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52074, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 380, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:11.607730+00:00", "ended_at": "2026-08-24T09:41:17.487095+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ccc6f944-a1da-420b-b1b9-8f5c0d7aa902", "name": "russet-humble-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36354, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:09.152339+00:00", "ended_at": "2026-08-24T09:41:12.737280+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78844a21-fa7f-4378-b67f-b5c1322899d2", "name": "spirited-oaken-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52070, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:41:03.206221+00:00", "ended_at": "2026-08-24T09:41:08.840679+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "956d915e-4900-4fb8-9029-27404382adaa", "name": "faded-grumpy-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58114, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:57.485519+00:00", "ended_at": "2026-08-24T09:41:00.604108+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a79028bb-c12b-44f9-b37b-4d0211d6e328", "name": "plucky-ancient-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34944, "username": "webadmin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:46.100574+00:00", "ended_at": "2026-08-24T09:40:51.805719+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4e58975d-7fa9-404b-a61c-2f09f91ecf30", "name": "plush-somber-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34942, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:40.916002+00:00", "ended_at": "2026-08-24T09:40:46.925893+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d74f5906-e447-4af9-b182-c7d155ac5246", "name": "zealous-hollow-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52862, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 423, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:33.115635+00:00", "ended_at": "2026-08-24T09:40:36.087031+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "88aec204-6494-4dd7-bef0-f3c047062a5a", "name": "coastal-peaty-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42446, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:28.844602+00:00", "ended_at": "2026-08-24T09:40:33.007035+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "51809591-353a-4d7f-90a7-6a1c5367d2f3", "name": "upland-obsidian-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36102, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:17.428247+00:00", "ended_at": "2026-08-24T09:40:21.633672+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d6b46958-bfa8-453b-a2d8-0bb610b586ae", "name": "muted-gentle-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58122, "username": "openclaw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:05.931941+00:00", "ended_at": "2026-08-24T09:40:09.549966+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f10f72f9-bc8c-4c66-9ac6-58b6154f978e", "name": "dutiful-dusky-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58104, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:02.525262+00:00", "ended_at": "2026-08-24T09:40:07.892398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9f52bd2f-34e1-466f-ba84-4e0527f1a48d", "name": "glassy-bitter-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38798, "username": "gns3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 369, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:40:01.715630+00:00", "ended_at": "2026-08-24T09:40:11.032170+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "10d1c156-a0ef-41f6-8237-1c7c78264f05", "name": "blithe-noble-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54568, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:49.534050+00:00", "ended_at": "2026-08-24T09:39:55.299455+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "12323093-eff4-46b8-8836-c457cc405f86", "name": "sunlit-drifting-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54560, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:43.152174+00:00", "ended_at": "2026-08-24T09:39:49.241670+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3769f87d-930f-4b4f-ab21-843745bb53bc", "name": "spirited-clever-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58094, "username": "vncuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:33.082499+00:00", "ended_at": "2026-08-24T09:39:43.002461+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "f920f1d4-e595-4f25-9a8f-5b748021c0de", "name": "loyal-lucid-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48844, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:31.816595+00:00", "ended_at": "2026-08-24T09:39:36.124426+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b6d1b967-4584-470d-9490-43f99f0aaed4", "name": "velvet-nimble-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59754, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 494, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:23.915843+00:00", "ended_at": "2026-08-24T09:39:27.836789+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c5eb97fc-2ed6-4231-a48b-e4c9543bd074", "name": "gloomy-reedy-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59732, "username": "coder", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:19.348255+00:00", "ended_at": "2026-08-24T09:39:27.008786+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "f47d9a2c-0479-435a-b5a4-78ffaa55a9b5", "name": "feathered-brazen-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59568, "username": "usuario", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:39:06.807254+00:00", "ended_at": "2026-08-24T09:39:11.786664+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "f5d61365-c888-4284-835b-5f5f2978ed09", "name": "canny-languid-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41604, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:59.985607+00:00", "ended_at": "2026-08-24T09:39:05.041153+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42e78b66-ea32-421b-9dae-05d9a6ab7e66", "name": "rambling-frosty-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59552, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:51.604627+00:00", "ended_at": "2026-08-24T09:38:54.815260+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10932995-b263-48a0-9ec9-533e1dc0af59", "name": "peaty-idle-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40310, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:46.536614+00:00", "ended_at": "2026-08-24T09:38:51.399629+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85792f74-18fb-46db-93d0-4144e19859ee", "name": "merry-nameless-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55108, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:32.518830+00:00", "ended_at": "2026-08-24T09:38:35.916812+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8975cc4f-d1c4-486b-8f0c-7b8c50f471fb", "name": "gloomy-flinty-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49226, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:28.100598+00:00", "ended_at": "2026-08-24T09:38:32.810204+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d225945b-c9d4-4946-babb-a98aef4a2b05", "name": "nimble-inland-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49228, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:26.829020+00:00", "ended_at": "2026-08-24T09:38:31.186604+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dde37499-d9b8-47b0-b1c1-018dded3ce4d", "name": "cunning-hollow-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34040, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 388, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:19.896118+00:00", "ended_at": "2026-08-24T09:38:23.590423+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e30f26b-80fd-4eef-af6f-a3725c411e2a", "name": "tender-dutiful-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51932, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:08.510645+00:00", "ended_at": "2026-08-24T09:38:14.593582+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "10d2bd7a-b1b6-461b-9ecb-1f501febd9f2", "name": "wiry-feral-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42208, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:38:01.890086+00:00", "ended_at": "2026-08-24T09:38:05.910147+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0f3b6a15-4257-4a4f-aa86-a3a727a62569", "name": "thrifty-zealous-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42178, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:50.640346+00:00", "ended_at": "2026-08-24T09:37:55.181634+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "635f77e1-3ac6-47d1-8275-8a28b855e8ca", "name": "inland-solemn-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42278, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 237, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:40.811371+00:00", "ended_at": "2026-08-24T09:37:43.887390+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "174cf265-92cf-4c59-8dec-f7405fb7dd12", "name": "rugged-somber-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56276, "username": "dani", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:31.108363+00:00", "ended_at": "2026-08-24T09:37:34.384104+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c856c58-46d9-4206-97fb-02c9cb2ef32a", "name": "prairie-thorny-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53672, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:31.015257+00:00", "ended_at": "2026-08-24T09:37:33.902272+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b2cdee9b-a4f2-4014-9a55-b99b8839cade", "name": "golden-jagged-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40742, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:16.338640+00:00", "ended_at": "2026-08-24T09:37:19.224595+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ccafbb89-a5ed-47c1-8bc9-949b7675d8af", "name": "proud-twilight-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56270, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:15.511609+00:00", "ended_at": "2026-08-24T09:37:21.340093+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7bf61550-36c0-42e6-b807-fd49a86b0af8", "name": "boreal-northern-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56046, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:06.523832+00:00", "ended_at": "2026-08-24T09:37:10.002859+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c923086e-1972-4d48-8c45-a637108fd809", "name": "downy-honest-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46078, "username": "agent", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 240, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:37:06.412824+00:00", "ended_at": "2026-08-24T09:37:12.113033+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "3f9cf4be-35d3-439e-ac28-a349f29b7a11", "name": "fickle-golden-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34174, "username": "niaoyun", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:55.814223+00:00", "ended_at": "2026-08-24T09:37:02.942385+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "6e1eaf8a-6fdc-48c7-b64c-da4011b145f1", "name": "dapper-dappled-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46064, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:49.897452+00:00", "ended_at": "2026-08-24T09:36:54.029896+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aa692eac-3347-4fd6-8afe-608891d6c645", "name": "gritty-autumn-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34392, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:41.034045+00:00", "ended_at": "2026-08-24T09:36:45.500323+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f534cb5b-6559-4d1f-9c67-9e4bca7790df", "name": "stoic-lonesome-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34372, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:33.452483+00:00", "ended_at": "2026-08-24T09:36:39.142867+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "defdbd3f-e340-4f3c-9a04-8ec1ae836689", "name": "sturdy-mottled-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49582, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:26.913515+00:00", "ended_at": "2026-08-24T09:36:30.883788+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "941c0b5b-d5ca-4381-8799-27f2ded16090", "name": "cosmic-murky-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60030, "username": "es", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:19.432433+00:00", "ended_at": "2026-08-24T09:36:23.426321+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d4cae631-bf11-47e4-885b-a8df1d14d7f3", "name": "ivory-honest-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60026, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:36:16.916561+00:00", "ended_at": "2026-08-24T09:36:19.801326+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "513b2634-19be-44b5-896b-dec9703569b5", "name": "craggy-woven-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45646, "username": "trade", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:59.909220+00:00", "ended_at": "2026-08-24T09:36:04.250779+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fdabe8fe-156d-4eff-a795-60fc163dc0d0", "name": "cunning-ivory-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53708, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:55.232410+00:00", "ended_at": "2026-08-24T09:36:01.200879+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a93d8f29-9020-4d4f-820e-b884a1d8f403", "name": "electric-mottled-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53694, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:48.311842+00:00", "ended_at": "2026-08-24T09:35:53.201247+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bc7b8838-252d-4356-8422-f6074c117b6a", "name": "salty-prairie-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57944, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:39.785749+00:00", "ended_at": "2026-08-24T09:35:45.224808+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3e6b16af-c3a4-4698-8144-0b928c26b6ad", "name": "hollow-stoic-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57420, "username": "webuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:37.731066+00:00", "ended_at": "2026-08-24T09:35:43.106462+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "2b0f6f48-2d03-46ff-9cb4-c25a4f55c833", "name": "obsidian-dutiful-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44516, "username": "odoo18", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 207, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:30.402634+00:00", "ended_at": "2026-08-24T09:35:33.531778+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d91d0dfd-8584-4a32-a7fa-33292c186a72", "name": "rambling-prairie-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57418, "username": "master", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:20.885475+00:00", "ended_at": "2026-08-24T09:35:26.786744+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "61960d11-3e7a-413e-8288-fc0e6001b32a", "name": "lucid-fringed-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60526, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:18.856603+00:00", "ended_at": "2026-08-24T09:35:24.541086+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "014241dc-cbdc-4b34-87b7-1ecdac4678cd", "name": "lonesome-lofty-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44312, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:08.723478+00:00", "ended_at": "2026-08-24T09:35:14.850847+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "42f53caf-eb4c-4707-96f3-2fcdeef2981a", "name": "windswept-scarlet-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44308, "username": "elrond", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:02.639611+00:00", "ended_at": "2026-08-24T09:35:11.027011+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "60722255-d4bb-483f-8438-3eddf4eee09d", "name": "blithe-granite-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46158, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:35:00.018742+00:00", "ended_at": "2026-08-24T09:35:03.526828+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4cccf9d2-821d-4f4c-b82e-a58920e41bec", "name": "chilly-humble-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36222, "username": "username", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:48.992144+00:00", "ended_at": "2026-08-24T09:34:54.545817+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "c65d544a-1d46-466c-bdf5-b1ce6d870d6d", "name": "languid-prairie-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43662, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:47.612687+00:00", "ended_at": "2026-08-24T09:34:52.482907+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "fff947c8-4201-4211-a3af-2d466ef91956", "name": "lonesome-russet-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36214, "username": "runner", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:33.310573+00:00", "ended_at": "2026-08-24T09:34:38.422130+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "da514e4b-0382-4afd-9200-9c1197186322", "name": "tawny-ruddy-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43334, "username": "guest", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:25.802812+00:00", "ended_at": "2026-08-24T09:34:31.328685+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e2c701f1-628c-4016-8c23-2f46b4a4bef0", "name": "hazy-creaky-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51872, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:22.713421+00:00", "ended_at": "2026-08-24T09:34:27.849409+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "80a24626-ccab-4425-bf91-2b975b35dc34", "name": "rapid-placid-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56590, "username": "manoj", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:16.808565+00:00", "ended_at": "2026-08-24T09:34:22.204608+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "4fbbcf87-7d7e-437b-8634-f546daf1f7ad", "name": "frugal-wry-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51854, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:06.337438+00:00", "ended_at": "2026-08-24T09:34:09.305488+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f4539268-ed9c-44d8-b1a4-a38ce5f1d92b", "name": "civil-lunar-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54918, "username": "ghost", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:34:02.286087+00:00", "ended_at": "2026-08-24T09:34:07.515425+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "bdbd51b1-4e95-4127-b2ed-5a2e84266c46", "name": "windswept-ashen-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54908, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:49.937189+00:00", "ended_at": "2026-08-24T09:33:54.744845+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7eb5298e-089e-42a9-996e-09f07dedbe42", "name": "coastal-jaunty-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41372, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:38.922200+00:00", "ended_at": "2026-08-24T09:33:44.843014+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9d3bc35a-697f-4da5-b0e8-3bc575110ccc", "name": "honest-fleeting-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56970, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 254, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:34.895245+00:00", "ended_at": "2026-08-24T09:33:39.445306+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "acf7dcb7-4b0a-4e51-a316-bc679dbec00f", "name": "brave-tangled-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56920, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 367, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:34.794116+00:00", "ended_at": "2026-08-24T09:33:40.121623+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "79a74117-919d-4747-9f1a-429cf8e10371", "name": "loyal-ancient-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33560, "username": "hummingbot", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:26.216192+00:00", "ended_at": "2026-08-24T09:33:31.697410+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1663 }, { "id": "22854369-7d06-497e-b9e4-058b724784d4", "name": "vernal-idle-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49610, "username": "cloud", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:22.411412+00:00", "ended_at": "2026-08-24T09:33:29.514401+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "fb860e9e-6982-4c1f-8e19-cc3f6b4908e3", "name": "dewy-honest-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53882, "username": "teamspeak", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 190, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:18.302453+00:00", "ended_at": "2026-08-24T09:33:25.598359+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "349cba39-f79d-4a78-824e-6f70da6321d2", "name": "lanky-tangled-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33108, "username": "bernard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:08.696583+00:00", "ended_at": "2026-08-24T09:33:17.014782+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "151943c9-12cd-4dad-9b75-426c85447c2e", "name": "sleepy-hollow-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53890, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:33:05.852404+00:00", "ended_at": "2026-08-24T09:33:11.426949+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d6183f12-9724-4589-9d50-3ef98252c592", "name": "fleeting-ruddy-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35524, "username": "teste", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 232, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:55.494726+00:00", "ended_at": "2026-08-24T09:33:00.427869+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78b40379-9dea-4704-bffa-ccfb2ff05fcd", "name": "nameless-tawny-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45248, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 188, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:38.914691+00:00", "ended_at": "2026-08-24T09:32:43.116809+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "841eb56a-0457-4da2-9ad0-ce55b8b8f40b", "name": "calm-silent-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33098, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:38.494287+00:00", "ended_at": "2026-08-24T09:32:42.399774+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d53b4360-967f-4cd4-ba67-34e79321d7e1", "name": "feathered-mighty-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42516, "username": "qw", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:35.395894+00:00", "ended_at": "2026-08-24T09:32:43.426870+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "40af7f73-dc51-4f02-9b43-dc03e95bb475", "name": "civil-vaulted-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:15.210220+00:00", "ended_at": "2026-08-24T09:32:20.249253+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b0324b44-cba3-4fc6-be87-697a54868eca", "name": "weathered-wandering-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39450, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:08.432526+00:00", "ended_at": "2026-08-24T09:32:11.313885+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8098325e-13d2-4046-84da-c6a91e00c8b6", "name": "supple-umber-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48698, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:32:07.317387+00:00", "ended_at": "2026-08-24T09:32:10.656039+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3133a291-34cc-49fa-b771-d4358bda910b", "name": "solar-jagged-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44282, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:59.327124+00:00", "ended_at": "2026-08-24T09:32:04.041883+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "25169a17-2716-43a6-ad88-a0abf0804e67", "name": "curious-seaward-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44252, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:56.413806+00:00", "ended_at": "2026-08-24T09:32:00.597718+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85a5c434-c1f8-4b32-af76-c21eb010fb68", "name": "velvet-emerald-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43832, "username": "amir", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:41.319559+00:00", "ended_at": "2026-08-24T09:31:46.792148+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9c2b84e7-6cbd-44bb-b482-4c187f34931c", "name": "balmy-frosty-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50556, "username": "mcserver", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:41.127878+00:00", "ended_at": "2026-08-24T09:31:49.007749+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "04dbcf55-b3ef-408e-a06a-7dab489195f3", "name": "freckled-marbled-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 50586, "username": "bob", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:37.730441+00:00", "ended_at": "2026-08-24T09:31:43.409598+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d7c00382-1490-4d30-8f9c-85f174ae4dd1", "name": "ancient-lonesome-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49426, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:26.516780+00:00", "ended_at": "2026-08-24T09:31:31.296613+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f456d465-afe2-4ac5-836e-ca8dc453d743", "name": "bashful-slender-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44226, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:14.633486+00:00", "ended_at": "2026-08-24T09:31:20.725070+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "665063a6-233f-4984-96f5-c62f3a087271", "name": "shaded-frosty-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53702, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:31:07.688964+00:00", "ended_at": "2026-08-24T09:31:11.117006+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd5ff4cc-e6a7-4b64-9d83-0830469dfaec", "name": "tranquil-chilly-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45682, "username": "edge", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:58.122887+00:00", "ended_at": "2026-08-24T09:31:05.102636+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "27770119-60d0-4e9c-8431-107c72fc15a3", "name": "boreal-graceful-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38348, "username": "nexus", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 194, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:57.420617+00:00", "ended_at": "2026-08-24T09:31:05.790389+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "af370e76-ca64-450a-8821-a40a943876b9", "name": "coral-crystal-yak", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53698, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 170, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:56.691478+00:00", "ended_at": "2026-08-24T09:31:00.424205+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "73799ed0-b50f-452c-8c7d-79ad92f72501", "name": "bold-silent-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45668, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:40.796441+00:00", "ended_at": "2026-08-24T09:30:46.021456+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "88a296fa-ffbe-44c0-aa89-458bcfd12488", "name": "faded-frank-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59946, "username": "opc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:38.218135+00:00", "ended_at": "2026-08-24T09:30:44.913184+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "35269b4a-530b-4c03-a69c-a4af3490a093", "name": "feathered-sturdy-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41868, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:32.143593+00:00", "ended_at": "2026-08-24T09:30:36.694024+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "324bd384-f33e-493b-944a-0a197ad17c70", "name": "stoic-granite-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41846, "username": "server", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:25.038161+00:00", "ended_at": "2026-08-24T09:30:29.403258+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "723d00b1-a32a-4f43-9da7-9310778ec19b", "name": "sincere-brave-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55154, "username": "gabriel", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:23.507375+00:00", "ended_at": "2026-08-24T09:30:31.429079+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "edeff0cc-7575-4d6e-9ccb-c35f3cb645ff", "name": "cheerful-rambling-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44692, "username": "erpnext", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:30:14.147467+00:00", "ended_at": "2026-08-24T09:30:19.809240+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "46177ba7-0e46-4ea2-bcf1-a08da8685096", "name": "calm-prickly-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44678, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:57.388929+00:00", "ended_at": "2026-08-24T09:30:00.852074+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f7823462-7fb5-493a-9cea-fc5454001b49", "name": "alpine-noble-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49956, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:49.994394+00:00", "ended_at": "2026-08-24T09:29:55.132496+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d2a6b058-1f14-4883-9194-5819a658e5c6", "name": "grumpy-alpine-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44334, "username": "labuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:46.739405+00:00", "ended_at": "2026-08-24T09:29:52.621130+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "120bde4d-c870-4de3-93c6-21105e103f52", "name": "rugged-blazing-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46080, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:44.309912+00:00", "ended_at": "2026-08-24T09:29:50.637082+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "eacca4c1-84b7-4578-95a6-3c6774a5eef1", "name": "sandy-faded-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 38528, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:21.607108+00:00", "ended_at": "2026-08-24T09:29:25.021411+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d9628882-7d41-4312-82eb-39511687695f", "name": "graceful-salty-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34860, "username": "pi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:11.146172+00:00", "ended_at": "2026-08-24T09:29:14.123516+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2353f206-37fe-4609-b451-8c5cc24f516d", "name": "misty-murky-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34846, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:09.928865+00:00", "ended_at": "2026-08-24T09:29:14.692299+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9eae382a-278f-47f2-8c68-8d5bbc324d1d", "name": "indigo-painted-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60504, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:05.799800+00:00", "ended_at": "2026-08-24T09:29:09.134070+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "2aba7cbb-d185-4140-80fb-21e6eb842f72", "name": "ancient-feral-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43790, "username": "ansible", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 214, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:29:02.189587+00:00", "ended_at": "2026-08-24T09:29:09.601252+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "e9d79181-54e5-4c7b-a88e-e9127684d09b", "name": "pleasant-crimson-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 43780, "username": "jay", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:58.103841+00:00", "ended_at": "2026-08-24T09:29:05.133038+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "5b3b796a-2637-4047-b4fa-9b4c7bded9a6", "name": "kindly-tender-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56900, "username": "app", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 473, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:41.503259+00:00", "ended_at": "2026-08-24T09:28:46.593925+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "23135961-af3a-463c-9ac8-b96be899d263", "name": "seaward-sterling-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33822, "username": "system", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:35.791634+00:00", "ended_at": "2026-08-24T09:28:42.214285+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "a56627c6-ae8f-4e40-87bc-8774a55c4cde", "name": "mossy-silent-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52138, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:23.210951+00:00", "ended_at": "2026-08-24T09:28:27.484677+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ae64b636-b572-47c0-8b66-1ffd41e03d3e", "name": "fearless-lonesome-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52108, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 212, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:18.108198+00:00", "ended_at": "2026-08-24T09:28:24.206804+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c6c43377-72f8-456f-8e2b-dcbf565a2ce5", "name": "pristine-quartz-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36154, "username": "web", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:09.947006+00:00", "ended_at": "2026-08-24T09:28:14.616164+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "40827285-2583-4237-bd68-6e20ad2358a3", "name": "hazy-lively-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52174, "username": "fahmi", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:07.304311+00:00", "ended_at": "2026-08-24T09:28:14.603885+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "e981e869-43c2-41bd-9df8-39c59461d61a", "name": "jovial-merry-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52178, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:28:06.919290+00:00", "ended_at": "2026-08-24T09:28:11.203663+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c3a1edb-8696-4393-bafb-19e2459ad157", "name": "hearty-frugal-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59352, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 222, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:54.198827+00:00", "ended_at": "2026-08-24T09:27:58.118130+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "97dd5899-e844-4e01-a719-e6bed9dc2911", "name": "airy-fearless-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42776, "username": "zabbix", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:51.622298+00:00", "ended_at": "2026-08-24T09:27:57.103291+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "bb6ecd1b-9659-4b75-941d-16c8bb1a38ac", "name": "subtle-sincere-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45002, "username": "vagrant", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:49.637309+00:00", "ended_at": "2026-08-24T09:27:55.018548+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "071c46f9-c8e3-4439-b70b-d455ea26f283", "name": "pristine-gentle-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42768, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:34.800832+00:00", "ended_at": "2026-08-24T09:27:40.787267+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6349adce-4e08-44d8-ba11-1c798a6251e4", "name": "upland-nautical-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42536, "username": "customer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:29.761152+00:00", "ended_at": "2026-08-24T09:27:36.708783+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "dfd16942-a742-4729-ac40-773a84d7df6c", "name": "fickle-northern-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46090, "username": "admin2", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:28.417258+00:00", "ended_at": "2026-08-24T09:27:34.735884+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4f8626f3-9024-44a8-9549-cf560d242cbc", "name": "rapid-inland-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46060, "username": "media", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:22.925098+00:00", "ended_at": "2026-08-24T09:27:30.088666+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "3b8a697a-9071-4ea2-93be-c377dbfdd0a0", "name": "hushed-proud-mole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56230, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:27:01.418870+00:00", "ended_at": "2026-08-24T09:27:06.139768+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "78944a46-4f43-4cf4-9696-993696ea0fed", "name": "nameless-smoky-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60880, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 554, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:56.898299+00:00", "ended_at": "2026-08-24T09:27:02.215083+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b79acf29-4687-4d47-82bf-4092d9c54d20", "name": "icy-placid-eider", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41946, "username": "core", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:55.110298+00:00", "ended_at": "2026-08-24T09:27:01.891208+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "935f2795-bcaf-4a21-abc1-6cfa151161e7", "name": "tidal-granite-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41964, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:52.484584+00:00", "ended_at": "2026-08-24T09:26:58.243888+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aed3987f-f613-4eba-9fb8-663ec4c65dbb", "name": "gentle-western-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41090, "username": "support", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 258, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:38.205587+00:00", "ended_at": "2026-08-24T09:26:43.021063+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f7c7b4e6-7177-4d0a-9751-7fb2d4fc5b65", "name": "humble-early-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44744, "username": "almalinux", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:27.235129+00:00", "ended_at": "2026-08-24T09:26:35.835137+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1662 }, { "id": "daf13c4d-cf72-4cec-91b2-94b01d1a483c", "name": "feathered-restless-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 44736, "username": "sam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:19.889825+00:00", "ended_at": "2026-08-24T09:26:23.830641+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ad7168f-2424-494a-bab4-fe4b5a3a9efe", "name": "gritty-solemn-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52714, "username": "service", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:19.140540+00:00", "ended_at": "2026-08-24T09:26:25.401494+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "560c3b8f-0f85-4e68-83ea-73e1c3f348a9", "name": "brave-nimble-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56820, "username": "tomcat", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:26:18.041128+00:00", "ended_at": "2026-08-24T09:26:23.217037+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "7770e0f5-26ea-4d9b-8868-4345f81a7d86", "name": "prickly-marbled-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37752, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:58.918342+00:00", "ended_at": "2026-08-24T09:26:03.350849+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bb3c5725-8f8b-4190-854e-33c684fdf58f", "name": "polar-wooded-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37728, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:49.429157+00:00", "ended_at": "2026-08-24T09:25:53.693494+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8c41058f-e8d9-459c-adc4-210c948fa75b", "name": "cunning-early-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60148, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:45.292065+00:00", "ended_at": "2026-08-24T09:25:50.722080+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "3ce2a05f-9a80-4a9b-8be6-8367b4307344", "name": "bold-drifting-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45564, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:30.609337+00:00", "ended_at": "2026-08-24T09:25:33.510010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "39a172fb-da17-4904-beaf-fea0e02989aa", "name": "ivory-spirited-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45560, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 201, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:29.397055+00:00", "ended_at": "2026-08-24T09:25:32.579847+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b3a8df5c-5534-440b-aecd-798a6e4897fe", "name": "solar-marine-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48698, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 218, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:23.316125+00:00", "ended_at": "2026-08-24T09:25:27.546214+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b6bc8518-63b2-4b1d-a317-79ec76711dd6", "name": "gritty-vigilant-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54386, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:20.086139+00:00", "ended_at": "2026-08-24T09:25:23.689793+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5570b8d6-3324-4589-9594-ce2382cc5901", "name": "hidden-subtle-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54374, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:09.705917+00:00", "ended_at": "2026-08-24T09:25:13.506966+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "085e6f12-46f2-4226-bd8e-502b45384113", "name": "polar-honest-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36802, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 315, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:25:06.716182+00:00", "ended_at": "2026-08-24T09:25:11.093216+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9356e8a2-f4be-4811-9bf0-72142db6c6a8", "name": "buoyant-mottled-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36642, "username": "ai", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:58.093392+00:00", "ended_at": "2026-08-24T09:25:05.320875+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "ad0c1ee8-ff52-43e5-ab5e-e013ea710bda", "name": "fickle-drifting-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36654, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:54.815019+00:00", "ended_at": "2026-08-24T09:24:58.827309+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "dd8c4441-7d52-4f2a-a88a-275a23fe2c15", "name": "smoky-mighty-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49234, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:42.649350+00:00", "ended_at": "2026-08-24T09:24:46.903106+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7921fa0c-fb70-4661-b610-ba1a3e2057c6", "name": "glassy-mindful-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57960, "username": "postgres", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:37.608260+00:00", "ended_at": "2026-08-24T09:24:40.420551+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "9b24dfda-a860-44c4-bdbf-371c84959ebd", "name": "sterling-hazy-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40912, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:31.402192+00:00", "ended_at": "2026-08-24T09:24:35.488280+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e792ad6-0bd3-42c5-b290-77d891fec6db", "name": "amber-quartz-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54214, "username": "gg", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:28.839534+00:00", "ended_at": "2026-08-24T09:24:35.249415+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1655 }, { "id": "cd7204ed-c188-4eb7-9c06-70792b5e126c", "name": "thawing-gleaming-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 40910, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:23.235679+00:00", "ended_at": "2026-08-24T09:24:28.836617+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4b810300-74a7-45aa-99d7-2c9179c76eed", "name": "steady-stoic-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48936, "username": "tempuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 206, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:13.242160+00:00", "ended_at": "2026-08-24T09:24:22.901593+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "8adee150-49ff-477e-a959-77d673b067fe", "name": "cheerful-indigo-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 48966, "username": "sftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:24:07.809423+00:00", "ended_at": "2026-08-24T09:24:14.081060+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e1211fea-98bc-4f01-a863-fee437c476c4", "name": "loyal-mottled-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33714, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:46.944351+00:00", "ended_at": "2026-08-24T09:23:49.818381+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7f2ff75f-ae10-4916-8659-e3e736cd7bb9", "name": "rapid-tawny-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60242, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:45.086293+00:00", "ended_at": "2026-08-24T09:23:50.688809+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "bf713ad1-88a6-41f0-9eb6-0a305145e6d7", "name": "dapper-honest-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59720, "username": "uploader", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:44.505230+00:00", "ended_at": "2026-08-24T09:23:51.294749+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "344a24cf-c3ea-4604-b7b5-bec79e56bf4a", "name": "drifting-serene-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60238, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:43.095048+00:00", "ended_at": "2026-08-24T09:23:47.303499+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b208e1ee-38b2-49b4-9a9c-c87086c839e0", "name": "lonesome-alpine-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46356, "username": "kingbase", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:22.152801+00:00", "ended_at": "2026-08-24T09:23:24.994010+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "680ade13-4b98-4407-8b54-d5cc38203d8f", "name": "proud-jolly-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 46334, "username": "ftpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:19.295405+00:00", "ended_at": "2026-08-24T09:23:23.195772+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "efb652b7-19cb-4493-bdfe-f52659b86887", "name": "mindful-whispering-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53512, "username": "Caps", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:15.719957+00:00", "ended_at": "2026-08-24T09:23:23.401397+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "112583b0-ee4b-4fdc-9f51-38a3d8883a4e", "name": "misty-woven-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45378, "username": "ranga", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 226, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:11.007231+00:00", "ended_at": "2026-08-24T09:23:16.601792+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "830931f6-361e-4de6-88ef-ac8430e818e0", "name": "fringed-jagged-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 52160, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:23:08.010609+00:00", "ended_at": "2026-08-24T09:23:13.922591+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a1f0622d-6ac3-45fa-b5bc-be777ec82067", "name": "curious-amber-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60730, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 208, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:44.114387+00:00", "ended_at": "2026-08-24T09:22:48.901721+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "04ab9f54-9cff-4c7a-897c-6119ad7bb71f", "name": "gloomy-ashen-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 53498, "username": "claude", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:43.114147+00:00", "ended_at": "2026-08-24T09:22:48.396683+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "71104f1d-93b5-4896-8262-5fd88e3c03a3", "name": "crimson-hollow-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42068, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 231, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:35.296303+00:00", "ended_at": "2026-08-24T09:22:39.099807+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "330a9fa6-814b-4ac6-a7bc-ce37e5e6cbd6", "name": "blithe-courtly-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42042, "username": "user1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 225, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:32.999783+00:00", "ended_at": "2026-08-24T09:22:36.024963+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "26aca87a-d71b-4b0b-906f-c6eb3a862b4f", "name": "marbled-gleaming-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45584, "username": "administrator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 219, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:28.308260+00:00", "ended_at": "2026-08-24T09:22:35.330925+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1661 }, { "id": "ab7bb6cb-5a9b-4803-87b1-c30d0e8d6f2e", "name": "bashful-coastal-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 58540, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:24.804722+00:00", "ended_at": "2026-08-24T09:22:29.521577+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cfa8d280-759e-4ad2-8852-c67dcf4e2fe9", "name": "somber-peaty-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45570, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 236, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:18.589151+00:00", "ended_at": "2026-08-24T09:22:22.209272+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "148cfa90-f4b8-4b85-874a-9f23fde056a1", "name": "gallant-mighty-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35324, "username": "wizard", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 252, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:22:16.117886+00:00", "ended_at": "2026-08-24T09:22:24.803825+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "05dcc378-82e8-4ad1-b7b8-4b061b00c2eb", "name": "spirited-daring-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33716, "username": "steam", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 233, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:54.406083+00:00", "ended_at": "2026-08-24T09:22:00.020084+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "6764a76c-212d-4f55-896f-231ca584be7c", "name": "barren-civil-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54828, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 223, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:47.811847+00:00", "ended_at": "2026-08-24T09:21:53.794626+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e5404832-cb88-4ed2-bf56-46748e77eea2", "name": "blunt-graceful-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 54818, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:43.840501+00:00", "ended_at": "2026-08-24T09:21:49.308000+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "4f5474d7-0be3-4adf-8a5e-09f313fa96ec", "name": "peaty-craggy-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55312, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 192, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:34.820333+00:00", "ended_at": "2026-08-24T09:21:39.820091+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "0a085723-2181-421e-a37b-9bea2cf3359d", "name": "dappled-graceful-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60832, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:31.413131+00:00", "ended_at": "2026-08-24T09:21:37.399559+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f987bb74-1a8d-4ef7-874b-d52a5c5915e5", "name": "gritty-prickly-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59878, "username": "config", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:21.889822+00:00", "ended_at": "2026-08-24T09:21:29.412767+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "c520fefe-7972-474b-a9c6-60409f0a676a", "name": "brazen-steady-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60814, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 554, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:18.843296+00:00", "ended_at": "2026-08-24T09:21:24.814673+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "11bbb591-6d7d-4d19-bb9e-4a9c2d3896bf", "name": "lucid-bronzed-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60372, "username": "test", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 276, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:06.696109+00:00", "ended_at": "2026-08-24T09:21:09.709728+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "096a1f90-de2a-4d64-ab4e-d6a0a156be92", "name": "glacial-inland-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 60364, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 228, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:21:01.230950+00:00", "ended_at": "2026-08-24T09:21:05.323319+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7fd1bd03-e44f-4942-b5d1-38c981b1a2d9", "name": "gallant-obsidian-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41622, "username": "sysupdate", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 244, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:54.028008+00:00", "ended_at": "2026-08-24T09:21:00.809702+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "30faf997-7f2c-448a-b780-e5326c1c4e90", "name": "dusty-marbled-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39458, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:50.468201+00:00", "ended_at": "2026-08-24T09:20:54.820740+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "ebec4d37-dad3-431b-b467-b2e258959443", "name": "leafy-humble-saola", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 33490, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:49.719110+00:00", "ended_at": "2026-08-24T09:20:54.646320+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "cb65c7ce-a773-4b1e-b595-9f9e16205d6f", "name": "merry-wiry-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49814, "username": "marcu1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 197, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:35.592171+00:00", "ended_at": "2026-08-24T09:20:41.719940+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e80da985-1df7-4b13-91f4-e9b5ceeb5c15", "name": "stormy-granite-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 41600, "username": "deploy", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:33.885458+00:00", "ended_at": "2026-08-24T09:20:36.627753+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7a6e2f7e-caf9-40d3-8d93-aea7a958e368", "name": "icy-jagged-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51678, "username": "appuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:26.903211+00:00", "ended_at": "2026-08-24T09:20:33.637829+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1660 }, { "id": "21ea9514-5257-4378-a93a-0bcb4ef9ee49", "name": "cheerful-blazing-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51650, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:14.714515+00:00", "ended_at": "2026-08-24T09:20:18.510554+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "8dd3e381-f9c7-4ed8-9a7a-ef70ff34dac4", "name": "primal-languid-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57590, "username": "operator", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 199, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:20:09.315429+00:00", "ended_at": "2026-08-24T09:20:14.135835+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1138bfa7-7ed7-4c86-b79b-6f19ed320c95", "name": "thorny-indigo-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39850, "username": "ubuntu", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 196, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:55.902059+00:00", "ended_at": "2026-08-24T09:20:01.347903+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "7f7c3ffa-10ed-45af-a398-14ef842e48dd", "name": "watchful-downy-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 35214, "username": "backup", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 205, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:55.733712+00:00", "ended_at": "2026-08-24T09:20:02.887088+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e2469bfb-6188-4525-a09a-3893e7bda266", "name": "amber-crisp-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39842, "username": "git", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:52.586527+00:00", "ended_at": "2026-08-24T09:19:57.098398+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1265f73e-6de5-449b-b524-47ea1d0440db", "name": "lively-shaded-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49944, "username": "myuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 243, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:37.707261+00:00", "ended_at": "2026-08-24T09:19:42.698812+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "038cb7c1-0331-466f-9b37-f49598d8eb69", "name": "austere-drifting-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34124, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:30.720614+00:00", "ended_at": "2026-08-24T09:19:35.428864+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b1ddec79-2b0d-474d-8249-424c7fb4382f", "name": "weathered-slender-kiwi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 49938, "username": "rdpuser", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 215, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:30.284901+00:00", "ended_at": "2026-08-24T09:19:35.740430+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "792f828e-b265-452b-b4fb-0ae60d5ed04a", "name": "subtle-twilight-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 34466, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 251, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:15.293969+00:00", "ended_at": "2026-08-24T09:19:18.492278+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "a43afd7f-f5cf-405d-95ae-36d77d5154e8", "name": "rugged-fleeting-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47670, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 198, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:04.033128+00:00", "ended_at": "2026-08-24T09:19:08.798780+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "1e76199c-8a41-4144-85fa-184d9cbb4095", "name": "dutiful-keen-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 47654, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 229, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:19:01.407078+00:00", "ended_at": "2026-08-24T09:19:05.348826+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "aea0cd4b-6fbd-4110-9de7-9c10b7f0b6a8", "name": "early-gallant-roebuck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37036, "username": "root1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:57.829062+00:00", "ended_at": "2026-08-24T09:19:03.211561+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "4775948b-e4c0-47e7-96b2-8d79bf1248dc", "name": "noble-plucky-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 55474, "username": "admin1", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 202, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:56.810546+00:00", "ended_at": "2026-08-24T09:18:59.907211+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c4c9c7bb-7f7b-4471-9dbd-785de58f7fc6", "name": "grumpy-marine-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37012, "username": "oracle", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:39.292170+00:00", "ended_at": "2026-08-24T09:18:44.720916+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "5ac6f19c-655c-4963-a045-75e90fc24ee5", "name": "muted-sullen-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42868, "username": "frappe", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 204, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:32.191955+00:00", "ended_at": "2026-08-24T09:18:37.241735+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "b9154518-b189-4d8f-aea8-3260408163aa", "name": "somber-obsidian-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57870, "username": "osmc", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:24.225023+00:00", "ended_at": "2026-08-24T09:18:29.003418+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "978e69b2-7cac-410d-ba83-ed9d9631bb53", "name": "earnest-proud-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57872, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 239, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:23.845239+00:00", "ended_at": "2026-08-24T09:18:29.290727+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "d4742ee8-ba16-4cef-8b23-8c4570139799", "name": "tranquil-curious-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51966, "username": "super", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 221, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:18.617392+00:00", "ended_at": "2026-08-24T09:18:25.812076+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1658 }, { "id": "0ce9e847-a9e6-436b-94ab-826e58d39be5", "name": "courtly-crisp-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 51956, "username": "ts3", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 238, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:16.206076+00:00", "ended_at": "2026-08-24T09:18:21.529759+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1656 }, { "id": "5cca6fe8-cb4d-4250-a8a0-2bd288b72195", "name": "pewter-fearless-llama", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 45078, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 217, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:18:12.710409+00:00", "ended_at": "2026-08-24T09:18:18.186731+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e8e13772-39a3-4fbc-bd9b-eab0d006deb1", "name": "bold-blithe-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 42112, "username": "john", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 249, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:51.195442+00:00", "ended_at": "2026-08-24T09:17:56.608861+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "e2872cf5-83f7-45a1-86e7-3d833f729fc3", "name": "brisk-murky-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37986, "username": "nginx", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 270, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:49.018315+00:00", "ended_at": "2026-08-24T09:17:57.110683+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1657 }, { "id": "9cf791fc-5347-4509-99cc-da6a166a6c36", "name": "slender-hardy-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 59594, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:48.790458+00:00", "ended_at": "2026-08-24T09:17:52.936092+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f754107c-2737-4cd4-b9b2-403783082298", "name": "gallant-orderly-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 37976, "username": "hadoop", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 191, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:33.361507+00:00", "ended_at": "2026-08-24T09:17:38.286337+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "e9053c61-0d55-4f03-9f04-806d43a9a9f9", "name": "mottled-vaulted-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 56554, "username": "deployer", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 399, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:24.537060+00:00", "ended_at": "2026-08-24T09:17:30.519218+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "f729c0b5-fa11-4ece-a727-0dc5ad103eb9", "name": "wiry-ginger-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36776, "username": "liyang", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 195, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:17.817314+00:00", "ended_at": "2026-08-24T09:17:24.785072+00:00", "ended_reason": "exec complete", "commands": 14, "transcript_bytes": 1659 }, { "id": "e5bed317-6e1e-49f7-9ffd-464973c42a3c", "name": "diligent-grumpy-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 36786, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 211, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:14.018039+00:00", "ended_at": "2026-08-24T09:17:17.631950+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "c006bc82-a257-4008-a865-dc59e32c2d98", "name": "blithe-dapper-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39972, "username": "dev", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 242, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:17:02.432284+00:00", "ended_at": "2026-08-24T09:17:08.020423+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "94c7bbdb-d02f-436a-8513-ea65b68e39e6", "name": "earnest-sooty-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 57154, "username": "dmdba", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 216, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:16:56.418031+00:00", "ended_at": "2026-08-24T09:17:02.306032+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 }, { "id": "85a157c7-5940-4374-98f1-59333cce1e74", "name": "civil-fierce-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.47.11", "src_port": 39850, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "uname -s -v -n -r -m", "started_at": "2026-08-24T09:16:47.396414+00:00", "ended_at": "2026-08-24T09:16:51.692928+00:00", "ended_reason": "exec complete", "commands": 12, "transcript_bytes": 864 } ]