{"ip":"129.121.50.245","first_seen":"2026-06-18T16:35:13.112417Z","last_seen":"2026-06-18T17:48:42.225041Z","geo":{"country":"Brazil","country_code":"BR","city":"Vinhedo","asn":"AS31898 Oracle Corporation","isp":"Oracle Corporation","lat":-23.0251,"lon":-46.9785},"stats":{"total_events":15,"ssh_events":15,"http_events":0,"ssh_failures":15,"http_4xx":0,"http_5xx":0,"distinct_usernames":15,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","ssh.stuffing","asn.coordinated"],"event_tags":[],"recent_events":[{"ts":"2026-06-18T17:48:42.225041Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oracle","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:46:20.761807Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"yuri","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:39:06.621664Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"sambauser","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:36:45.138965Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"frappe","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:31:47.321591Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"linda","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:27:04.165204Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bash","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:22:26.816218Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deployer","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:20:11.214575Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"junior","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:17:43.534685Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vpn","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:15:18.379986Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dev","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T17:01:13.68967Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"clamav","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T16:54:00.715767Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"alin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T16:44:19.266366Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test12345","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T16:42:03.972208Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-18T16:35:13.112417Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mcserver","host_app":"host","source_host":"ironcat","tags":[]}],"generated_at":"2026-06-28T08:51:29.568179184Z"}