{"ip":"171.25.158.57","first_seen":"2026-08-16T17:19:13.333423Z","last_seen":"2026-08-16T18:54:01.204698Z","geo":{"country":"Sweden","country_code":"SE","city":"Vaxjo","asn":"AS35100 Patrik Lagerman","isp":"Patrik Lagerman","lat":56.8746,"lon":14.8124},"stats":{"total_events":36,"ssh_events":36,"http_events":0,"ssh_failures":36,"http_4xx":0,"http_5xx":0,"distinct_usernames":35,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["asn.coordinated","ssh.bruteforce","ssh.stuffing","subnet.coordinated"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-16T18:54:01.204698Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"nw","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:52:03.523726Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"elasticsearch","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-16T18:50:06.018444Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"antonio","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:46:05.946294Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"demo","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:42:12.003849Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"github","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:40:09.982474Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"kibana","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-16T18:38:10.850395Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-16T18:36:09.054674Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-16T18:32:16.336518Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"icecast","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:28:20.862833Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"suraj","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:26:23.259807Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"n8n","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:24:20.545875Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dev","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-16T18:22:12.380002Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mc2","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:20:13.903064Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"njzf","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:18:20.236418Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ops","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:16:22.686805Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vamsi","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:14:28.714777Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"hr","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:12:36.281183Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"prueba","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:08:29.112147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jairo","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:06:32.299777Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ems","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:04:30.372833Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"tobias","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T18:02:31.004278Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-16T18:00:38.706511Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jasper","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T17:58:43.742086Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dovecot","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-16T17:56:45.443289Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ddd","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]}],"generated_at":"2026-08-25T18:03:45.629882225Z"}