{"ip":"20.215.211.246","first_seen":"2026-06-26T13:00:55.518694Z","last_seen":"2026-06-26T13:00:55.525063Z","geo":{"country":"Poland","country_code":"PL","city":"Warsaw","asn":"AS8075 Microsoft Corporation","isp":"Microsoft Corporation","lat":52.23537,"lon":21.009485},"stats":{"total_events":17,"ssh_events":17,"http_events":0,"ssh_failures":17,"http_4xx":0,"http_5xx":0,"distinct_usernames":14,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","ssh.stuffing","cluster.shared_wordlist"],"event_tags":[],"recent_events":[{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user10","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bob","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"administrator","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ahmad","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.524248Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.524248Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user001","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"comunicacao","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"morris","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rescue","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"loginuser","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dreamnine","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user1","host_app":"host","source_host":"ironcat","tags":[]}],"generated_at":"2026-06-28T08:57:35.176126097Z"}