{"ip":"212.127.90.236","first_seen":"2026-08-25T04:06:15.280944Z","last_seen":"2026-08-25T06:53:05.397358Z","geo":{"country":"Poland","country_code":"PL","city":"Wroclaw","asn":"AS35179 Korbank S. A.","isp":"Korbank S.A","lat":51.1098,"lon":17.0168},"stats":{"total_events":27,"ssh_events":27,"http_events":0,"ssh_failures":27,"http_4xx":0,"http_5xx":0,"distinct_usernames":15,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["cluster.shared_wordlist","ssh.bruteforce","ssh.stuffing"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-25T06:53:05.397358Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"kali","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:49:27.39891Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"operator","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:45:54.795303Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:42:16.702201Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:38:17.618864Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"pi","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:23:13.547911Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:19:24.585429Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user1","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:15:41.67276Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T06:11:57.577983Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"cirros","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T06:08:14.491501Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:57:20.514755Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:53:43.699615Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:45:56.860417Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:23:45.250442Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:19:52.459299Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"guest","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:15:54.41334Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:11:55.131413Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"sshadmin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:07:51.468568Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"debian","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T05:04:03.980824Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T05:00:14.423055Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T04:48:14.79657Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T04:40:18.171752Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T04:36:14.265108Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"support","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-25T04:31:45.704388Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"orangepi","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-25T04:19:13.092957Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]}],"generated_at":"2026-08-25T18:04:39.978338506Z"}