{"ip":"91.92.40.12","first_seen":"2026-06-20T01:14:46.767613Z","last_seen":"2026-06-26T18:01:03.936694Z","geo":{"country":"Bulgaria","country_code":"BG","city":"Varna","isp":"BULLETGROUP","lat":43.1753,"lon":27.9041},"stats":{"total_events":91,"ssh_events":91,"http_events":0,"ssh_failures":91,"http_4xx":0,"http_5xx":0,"distinct_usernames":10,"distinct_paths":0,"distinct_source_hosts":2},"behavior_tags":["ssh.bruteforce","ssh.stuffing","actor.persistent","actor.multi_vm","subnet.coordinated"],"event_tags":[],"recent_events":[{"ts":"2026-06-26T18:01:03.936694Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T18:00:36.24661Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-26T17:59:45.830289Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T17:59:16.286801Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dspace","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"dspace","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.454115Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"git","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.450618Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ansible","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.450618Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ansible","host_app":"host","source_host":"ironcat","tags":[]},{"ts":"2026-06-26T13:00:55.450618Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ansible","host_app":"host","source_host":"ironcat","tags":[]}],"generated_at":"2026-06-28T05:59:15.636374108Z"}