{"ip":"79.72.57.232","first_seen":"2026-06-28T05:30:58.233186Z","last_seen":"2026-06-28T05:31:29.70403Z","geo":{"country":"Spain","country_code":"ES","city":"Madrid","asn":"AS31898 Oracle Corporation","isp":"Oracle Corporation","lat":40.4327,"lon":-3.621},"stats":{"total_events":29,"ssh_events":29,"http_events":0,"ssh_failures":29,"http_4xx":0,"http_5xx":0,"distinct_usernames":11,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","ssh.stuffing","asn.coordinated","cluster.shared_wordlist"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-06-28T05:31:29.70403Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"baikal","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:28.669856Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"pi","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:27.503755Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:26.20665Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:24.909152Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:23.874336Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test2","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:22.703694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test2","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:20.62723Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test2","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:20.62723Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test1","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:19.328494Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test1","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:18.031959Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test1","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:16.73248Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:15.436217Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:14.14161Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:13.089763Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:11.790277Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:10.755687Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:09.455932Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:08.289872Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:06.218322Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"usuario","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:06.218322Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:04.918984Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"usuario","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:03.621002Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"usuario","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-06-28T05:31:02.452778Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oracle","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-06-28T05:31:01.153702Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oracle","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]}],"generated_at":"2026-06-28T08:30:02.905050699Z"}