{"ip":"201.49.98.251","first_seen":"2026-06-26T13:00:55.518694Z","last_seen":"2026-06-26T13:00:55.527387Z","geo":{"country":"Brazil","country_code":"BR","city":"São Paulo","asn":"AS16735 ALGAR TELECOM S/A","isp":"ALGAR TELECOM S/A","lat":-23.6293,"lon":-46.6351},"stats":{"total_events":17,"ssh_events":17,"http_events":0,"ssh_failures":17,"http_4xx":0,"http_5xx":0,"distinct_usernames":14,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","ssh.stuffing","cluster.shared_wordlist"],"event_tags":[],"recent_events":[{"ts":"2026-06-26T13:00:55.527387Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user1","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.527387Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ahmad","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"morris","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.525063Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user10","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.524248Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user001","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.524248Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.524248Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"comunicacao","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"loginuser","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.51988Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dreamnine","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bob","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"administrator","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.518694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rescue","host_app":"host","source_host":"ironcat","tags":[]}],"generated_at":"2026-06-28T08:46:18.161224481Z"}