{"ip":"81.192.46.49","first_seen":"2026-08-04T22:37:44.145067Z","last_seen":"2026-08-22T02:18:14.48779Z","geo":{"country":"Morocco","country_code":"MA","city":"Casablanca","asn":"AS6713 Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM","isp":"ONPT","lat":33.5922,"lon":-7.6184},"stats":{"total_events":60,"ssh_events":60,"http_events":0,"ssh_failures":60,"http_4xx":0,"http_5xx":0,"distinct_usernames":56,"distinct_paths":0,"distinct_source_hosts":2},"behavior_tags":["actor.multi_vm","actor.persistent","cluster.shared_wordlist","ssh.bruteforce","ssh.stuffing","subnet.coordinated"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-22T02:18:14.48779Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"wangyao","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T02:14:08.019878Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ts3","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T02:12:00.170659Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"amit","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T02:07:53.104132Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vikas","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T02:05:52.8945Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"joe","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T02:03:49.956949Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T02:01:50.885294Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"devuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:59:38.487867Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"james","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:53:13.891704Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"deploy","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T01:49:08.331927Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"duc","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:44:58.249315Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"connect","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:42:50.253899Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"app","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:40:37.697388Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dat","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:34:11.500555Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vmail","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:32:06.797795Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T01:30:04.70497Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vncuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:27:57.63115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"trading","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:25:44.370772Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rtc","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:23:36.154569Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mysql","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T01:19:28.107479Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftpuser","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-22T01:17:32.018916Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jon","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:15:33.553301Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rita","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:11:14.832159Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jorgodubare","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T01:04:52.646054Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"fivem","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-08-22T00:56:44.525463Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"andrey","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]}],"generated_at":"2026-08-25T18:02:59.426883711Z"}