{"ip":"94.228.192.82","first_seen":"2026-08-03T13:51:45.164786Z","last_seen":"2026-08-05T16:10:41.698642Z","geo":{"country":"Russia","country_code":"RU","city":"Moscow","asn":"AS48293 Uniontel Ltd","isp":"Uniontel ZAO network","lat":55.7157,"lon":37.754},"stats":{"total_events":96,"ssh_events":96,"http_events":0,"ssh_failures":96,"http_4xx":0,"http_5xx":0,"distinct_usernames":81,"distinct_paths":0,"distinct_source_hosts":2},"behavior_tags":["actor.multi_vm","actor.persistent","ssh.bruteforce","ssh.stuffing"],"event_tags":["ssh.dictionary","ssh.enum"],"recent_events":[{"ts":"2026-08-05T16:10:41.698642Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"kibana","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-05T16:06:18.356509Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-05T16:01:54.62591Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"simpel","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:59:44.896626Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"manu","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:55:09.992642Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"zy","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:53:00.694682Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"test","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-05T15:50:49.433013Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-05T15:48:40.531721Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ekp","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:46:31.638015Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"meta","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:42:03.466127Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"wangjian","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:39:50.264732Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"icehrm","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:37:27.717445Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"halo","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:33:01.446937Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"hugo","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:28:31.557309Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"mailuser","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:26:09.149071Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"karla","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:19:13.626026Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"tbadmin","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:16:58.371208Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"user10","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:12:31.439469Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"aswin","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:10:13.240286Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"jy","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:07:54.809318Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]},{"ts":"2026-08-05T15:05:21.632977Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"blog","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T15:03:15.954303Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"composeruser","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T14:58:47.872332Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"rakesh","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T14:56:37.081188Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ca","host_app":"host","source_host":"ironcat","tags":["ssh.enum"]},{"ts":"2026-08-05T14:54:14.466759Z","source":"ssh","category":"auth.failure","severity":"warn","user_name":"ubuntu","host_app":"host","source_host":"ironcat","tags":["ssh.enum","ssh.dictionary"]}],"generated_at":"2026-08-25T18:00:09.021165014Z"}