{"ip":"208.69.78.36","first_seen":"2026-07-31T04:28:31.797912Z","last_seen":"2026-08-01T18:37:22.550863Z","geo":{"country":"Switzerland","country_code":"CH","city":"Zurich","asn":"AS63023 GTHost","isp":"Ontario Inc.","lat":47.3768,"lon":8.5416},"stats":{"total_events":819,"ssh_events":819,"http_events":0,"ssh_failures":819,"http_4xx":0,"http_5xx":0,"distinct_usernames":304,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["actor.persistent","ssh.bruteforce","ssh.stuffing"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-01T18:37:22.550863Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"apache","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:36:03.251301Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bitrix24","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:34:45.360745Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bot","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:33:27.58689Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"bs","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:32:08.964561Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"david","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:30:48.177104Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:29:28.526774Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:28:10.194682Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:26:51.211979Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:25:32.353564Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:24:11.944613Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:22:53.61099Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-01T18:21:35.718736Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deployer","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:20:17.664163Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dev","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-01T18:18:57.897623Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dev","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-01T18:17:37.782295Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"developer","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-01T18:16:18.813557Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"devuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:15:00.314827Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"docker","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:13:42.31527Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"docker","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:12:22.976012Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dolphinscheduler","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:11:03.326731Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"elastic","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:09:45.439238Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"feng","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:08:28.309537Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"f","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:07:09.650703Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftptest","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-01T18:05:49.023882Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]}],"generated_at":"2026-08-25T17:50:38.493848502Z"}