{"ip":"129.121.47.136","first_seen":"2026-06-27T15:58:57.872662Z","last_seen":"2026-06-27T16:55:26.308046Z","geo":{"country":"Brazil","country_code":"BR","city":"Vinhedo","asn":"AS31898 Oracle Corporation","isp":"Oracle Corporation","lat":-23.0251,"lon":-46.9785},"stats":{"total_events":16,"ssh_events":16,"http_events":0,"ssh_failures":16,"http_4xx":0,"http_5xx":0,"distinct_usernames":15,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","ssh.stuffing","asn.coordinated","cluster.shared_wordlist"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-06-27T16:55:26.308046Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-27T16:51:19.87571Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"claude","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:49:18.336234Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"linuxbrew","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:47:02.308675Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"work","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:38:54.868114Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"scanner","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:36:53.846225Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"move","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:34:46.341477Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test1","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:24:22.356174Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"auditor","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:21:59.633777Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"newuser","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-06-27T16:13:42.043274Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"boda","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-27T16:11:41.014637Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"es","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-27T16:09:35.638438Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oscar","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-27T16:07:37.2856Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-27T16:03:37.227574Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dolphin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-27T16:01:05.450901Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"administrator","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-27T15:58:57.872662Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"docs","host_app":"host","source_host":"ironcat","tags":[]}],"generated_at":"2026-06-28T05:59:31.6575616Z"}