{"ip":"91.92.40.231","first_seen":"2026-06-27T07:08:12.422869Z","last_seen":"2026-06-27T10:07:37.981782Z","geo":{"country":"Bulgaria","country_code":"BG","city":"Varna","isp":"BULLETGROUP","lat":43.1753,"lon":27.9041},"stats":{"total_events":58,"ssh_events":58,"http_events":0,"ssh_failures":58,"http_4xx":0,"http_5xx":0,"distinct_usernames":4,"distinct_paths":0,"distinct_source_hosts":1},"behavior_tags":["ssh.bruteforce","subnet.coordinated"],"event_tags":[],"recent_events":[{"ts":"2026-06-27T10:07:37.981782Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T10:03:29.641174Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:59:38.293011Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:55:24.072181Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:51:03.868994Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:46:39.273351Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:42:17.022497Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:37:52.426077Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:33:42.040428Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:29:52.438129Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:26:11.433967Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:22:29.864721Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:18:56.6926Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:15:15.00298Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:11:58.467979Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:08:25.268716Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:04:43.858929Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T09:01:10.671382Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:57:37.192678Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:54:10.384799Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:50:47.448605Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:47:34.74557Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"postgres","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:44:24.121601Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mysql","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:41:21.677058Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mysql","host_app":"host","source_host":"ironcatlabs","tags":[]},{"ts":"2026-06-27T08:38:10.974288Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mysql","host_app":"host","source_host":"ironcatlabs","tags":[]}],"generated_at":"2026-06-28T05:52:40.629043037Z"}