{"ip":"189.194.140.170","first_seen":"2026-08-14T04:47:50.458404Z","last_seen":"2026-08-22T03:32:13.811978Z","geo":{"country":"Mexico","country_code":"MX","city":"Puebla City","asn":"AS13999 Mega Cable, S.A. de C.V.","isp":"Mega Cable, S.A. de C.V.","lat":19.0348,"lon":-98.2172},"stats":{"total_events":69,"ssh_events":69,"http_events":0,"ssh_failures":69,"http_4xx":0,"http_5xx":0,"distinct_usernames":62,"distinct_paths":0,"distinct_source_hosts":2},"behavior_tags":["actor.multi_vm","actor.persistent","cluster.shared_wordlist","ssh.bruteforce","ssh.stuffing"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-22T03:32:13.811978Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ociispth","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T03:30:06.30815Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"milan","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T03:27:53.19166Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T03:23:16.576247Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jrodrig","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T03:20:55.046405Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"myftp","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T03:16:33.832659Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oracle","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T03:14:21.595133Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T03:12:09.795991Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin1","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T03:09:53.715555Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T03:07:30.285283Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T03:00:45.379494Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"nikhil","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:56:10.694498Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"server","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:53:45.787535Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"myappuser","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:46:15.75605Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T02:43:55.319027Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"cristian","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:41:40.296117Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"confluence","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:37:05.78572Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T02:32:25.622982Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"aris","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:30:02.406077Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oussama","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:27:48.306034Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T02:21:04.24335Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"redmine","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:18:45.779303Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ansible","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:16:21.143348Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"david","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-22T02:14:04.787163Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dev","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T02:09:33.46121Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"gopal","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]}],"generated_at":"2026-08-25T18:13:42.9269728Z"}