{"ip":"158.174.211.17","first_seen":"2026-08-25T04:53:44.33988Z","last_seen":"2026-08-25T06:59:29.705486Z","geo":{"country":"Sweden","country_code":"SE","city":"Färjestaden","asn":"AS8473 Bahnhof AB","isp":"Bahnhof AB","lat":56.65,"lon":16.45},"stats":{"total_events":33,"ssh_events":33,"http_events":0,"ssh_failures":33,"http_4xx":0,"http_5xx":0,"distinct_usernames":32,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["asn.coordinated","cluster.shared_wordlist","ssh.bruteforce","ssh.stuffing"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-25T06:59:29.705486Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"tech","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:56:51.57926Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"james","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:54:25.259017Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"wangyao","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:49:19.567956Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"joe","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:44:09.505033Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"umair","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:41:36.26357Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ts3","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:33:54.629991Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:31:19.346939Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rtc","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:18:14.636702Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"duc","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:15:43.435738Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:13:10.571357Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:08:08.742262Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rita","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:05:26.345593Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"connect","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:02:54.361632Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"fivem","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:00:17.351355Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"app","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:57:51.58592Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vmail","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:55:22.576276Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"andrey","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:50:25.350538Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"crafty","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:47:44.577376Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dat","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:42:31.67834Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vncuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:37:38.34783Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"devuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:35:08.264308Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mysql","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:32:36.339988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"trading","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:29:57.602559Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jon","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:24:52.34029Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jorgodubare","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]}],"generated_at":"2026-08-25T18:03:14.58060227Z"}