{"ip":"94.154.43.254","first_seen":"2026-09-26T01:01:59.572368Z","last_seen":"2026-09-26T11:54:44.963756Z","geo":{"country":"The Netherlands","country_code":"NL","city":"Amsterdam","asn":"AS219502 Storm Industries LLC","isp":"Storm Industries LLC","lat":52.3716,"lon":4.8883},"stats":{"total_events":14,"ssh_events":14,"http_events":0,"ssh_failures":14,"http_4xx":0,"http_5xx":0,"distinct_usernames":4,"distinct_paths":0,"distinct_source_hosts":2},"behavior_tags":["actor.multi_vm","asn.coordinated","ssh.bruteforce","subnet.coordinated"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-09-26T11:54:44.963756Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:44.302185Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:43.681925Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"support","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:41.602509Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:39.718671Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"support","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:39.666848Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:39.660581Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T11:54:39.652276Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironhawk","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T01:02:22.515955Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T01:01:59.757564Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T01:01:59.655977Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T01:01:59.581924Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T01:01:59.57802Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-26T01:01:59.572368Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"vyos","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-09-24T13:13:33.160389Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-24T13:13:31.881698Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"cisco","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-09-24T13:13:29.958799Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oracle","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-24T13:13:28.706209Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-24T13:13:28.087719Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-24T13:13:28.083134Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-24T13:13:28.066039Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"cisco","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum"]},{"ts":"2026-09-24T13:13:28.025865Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"oracle","host_app":"host","source_host":"ironcatlabs","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-22T12:38:51.426924Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-22T12:38:50.475435Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"admin","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-09-22T12:38:49.089377Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ftp","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]}],"generated_at":"2026-10-25T02:27:39.372767523Z"}