{"ip":"81.192.46.32","first_seen":"2026-10-07T20:28:07.817526Z","last_seen":"2026-10-09T02:59:15.422119Z","geo":{"country":"Morocco","country_code":"MA","city":"Casablanca","asn":"AS6713 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM","isp":"ONPT","lat":33.5922,"lon":-7.6184},"stats":{"total_events":27,"ssh_events":27,"http_events":0,"ssh_failures":27,"http_4xx":0,"http_5xx":0,"distinct_usernames":27,"distinct_paths":0,"distinct_source_hosts":2},"behavior_tags":["actor.multi_vm","asn.coordinated","ssh.bruteforce","ssh.stuffing","subnet.coordinated"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-10-09T02:59:15.422119Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"soporte","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:58:00.400326Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"pratik","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:56:44.131421Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-10-09T02:54:22.131764Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"tester","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:51:50.426194Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ctl","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:50:33.038615Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-10-09T02:49:19.101403Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"sam","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:44:16.177193Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"logviewer","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:40:41.062967Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-10-09T02:39:27.127146Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"friend","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:38:09.435206Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"odoo","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-09T02:36:54.17066Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ircd","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-10-07T20:57:48.278671Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ali","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:54:02.735918Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-10-07T20:52:45.144208Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"college","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:51:29.082153Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"taufik","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:50:12.921354Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dev","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-10-07T20:48:56.153716Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test123","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:47:37.277994Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"etienne","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:46:18.238002Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rftest","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:42:26.699108Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"distro","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:41:15.179322Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"greg","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:40:02.028824Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"steam","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:38:46.227219Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mp","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]},{"ts":"2026-10-07T20:37:30.0884Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"cs","host_app":"host","source_host":"ironhawk","tags":["ssh.enum"]}],"generated_at":"2026-10-26T11:53:03.525540505Z"}