{"ip":"206.251.48.204","first_seen":"2026-06-26T13:00:55.079331Z","last_seen":"2026-06-26T13:00:55.098475Z","geo":{"country":"Germany","country_code":"DE","city":"Frankfurt am Main","asn":"AS26383 Baxet Group Inc.","isp":"Baxet Group Inc.","lat":50.1109,"lon":8.68213},"stats":{"total_events":20,"ssh_events":20,"http_events":0,"ssh_failures":20,"http_4xx":0,"http_5xx":0,"distinct_usernames":20,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","ssh.stuffing","cluster.shared_wordlist"],"event_tags":[],"recent_events":[{"ts":"2026-06-26T13:00:55.098475Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test5","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.098475Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"apt","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.098475Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"location","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.098475Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"era","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.098475Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"finanse","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.098475Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"common","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"subscribe","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mweb","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"myadmin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ica","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bpi","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"imtest","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bug","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mox","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test-www","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.088147Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"skb","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.079331Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"pantera","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.079331Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"fst","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.079331Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"smtprelay","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.079331Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"prestashop","host_app":"host","source_host":"ironcat","tags":[]}],"generated_at":"2026-06-28T06:07:59.799875448Z"}