{"ip":"125.39.11.27","exported_at":"2026-06-17T12:16:02+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":78,"attack_stage":null,"attack_chain_stage":null,"threat_family":[],"recommended_action":null,"confidence":null,"risk_breakdown":[],"mitre_tactics":[],"mitre_technique":null,"top_mitre_technique":null,"top_mitre_count":null,"executive_one_liner_fr":"risque 76\/100","campaign_hint_fr":null,"confidence_breakdown":[],"persona_hostname":null,"correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":null,"confidence_hint_fr":null,"sensor_role_label_fr":null,"tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":null,"protocol_details":[],"protocol_summary_fr":null,"evidence_snippet":null,"target_port_label":null,"emulator_service":null,"confidence_reason":null,"classification_reason":null,"classification_reason_label_fr":null,"confidence_factors_fr":null,"payload_preview":null},"events":[{"id":8010505,"ip":"125.39.11.27","ts":"2026-05-30 19:59:36.000000","proto":"tcp","src_port":38890,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010486,"ip":"125.39.11.27","ts":"2026-05-30 19:59:18.000000","proto":"tcp","src_port":36330,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010472,"ip":"125.39.11.27","ts":"2026-05-30 19:58:59.000000","proto":"tcp","src_port":33774,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010454,"ip":"125.39.11.27","ts":"2026-05-30 19:58:38.000000","proto":"tcp","src_port":59444,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010445,"ip":"125.39.11.27","ts":"2026-05-30 19:58:15.000000","proto":"tcp","src_port":56880,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010430,"ip":"125.39.11.27","ts":"2026-05-30 19:57:52.000000","proto":"tcp","src_port":54318,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010410,"ip":"125.39.11.27","ts":"2026-05-30 19:57:13.000000","proto":"tcp","src_port":51742,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010380,"ip":"125.39.11.27","ts":"2026-05-30 19:55:33.000000","proto":"tcp","src_port":49098,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 76, \u0022campaign_key\u0022: \u00224b687cfbd2a2f5b43a89ec258bffd822ae9203ba\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010355,"ip":"125.39.11.27","ts":"2026-05-30 19:53:58.000000","proto":"tcp","src_port":46468,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010326,"ip":"125.39.11.27","ts":"2026-05-30 19:52:25.000000","proto":"tcp","src_port":43838,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010306,"ip":"125.39.11.27","ts":"2026-05-30 19:51:07.000000","proto":"tcp","src_port":41224,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010297,"ip":"125.39.11.27","ts":"2026-05-30 19:50:04.000000","proto":"tcp","src_port":38622,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010252,"ip":"125.39.11.27","ts":"2026-05-30 19:49:08.000000","proto":"tcp","src_port":36030,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8010040,"ip":"125.39.11.27","ts":"2026-05-30 19:48:18.000000","proto":"tcp","src_port":33440,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009963,"ip":"125.39.11.27","ts":"2026-05-30 19:47:42.000000","proto":"tcp","src_port":59098,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009943,"ip":"125.39.11.27","ts":"2026-05-30 19:47:08.000000","proto":"tcp","src_port":56522,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009925,"ip":"125.39.11.27","ts":"2026-05-30 19:46:37.000000","proto":"tcp","src_port":53950,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009900,"ip":"125.39.11.27","ts":"2026-05-30 19:46:10.000000","proto":"tcp","src_port":51378,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009875,"ip":"125.39.11.27","ts":"2026-05-30 19:45:44.000000","proto":"tcp","src_port":48820,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009859,"ip":"125.39.11.27","ts":"2026-05-30 19:45:20.000000","proto":"tcp","src_port":46254,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009845,"ip":"125.39.11.27","ts":"2026-05-30 19:44:59.000000","proto":"tcp","src_port":43696,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009822,"ip":"125.39.11.27","ts":"2026-05-30 19:44:39.000000","proto":"tcp","src_port":41136,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009817,"ip":"125.39.11.27","ts":"2026-05-30 19:44:20.000000","proto":"tcp","src_port":38580,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009810,"ip":"125.39.11.27","ts":"2026-05-30 19:44:02.000000","proto":"tcp","src_port":36020,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009807,"ip":"125.39.11.27","ts":"2026-05-30 19:43:45.000000","proto":"tcp","src_port":33466,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009796,"ip":"125.39.11.27","ts":"2026-05-30 19:43:29.000000","proto":"tcp","src_port":59136,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009789,"ip":"125.39.11.27","ts":"2026-05-30 19:43:14.000000","proto":"tcp","src_port":56584,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009772,"ip":"125.39.11.27","ts":"2026-05-30 19:42:59.000000","proto":"tcp","src_port":54034,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009765,"ip":"125.39.11.27","ts":"2026-05-30 19:42:45.000000","proto":"tcp","src_port":51476,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009755,"ip":"125.39.11.27","ts":"2026-05-30 19:42:32.000000","proto":"tcp","src_port":48926,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009748,"ip":"125.39.11.27","ts":"2026-05-30 19:42:19.000000","proto":"tcp","src_port":46372,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009743,"ip":"125.39.11.27","ts":"2026-05-30 19:42:07.000000","proto":"tcp","src_port":43816,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009734,"ip":"125.39.11.27","ts":"2026-05-30 19:41:55.000000","proto":"tcp","src_port":41268,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009722,"ip":"125.39.11.27","ts":"2026-05-30 19:41:43.000000","proto":"tcp","src_port":38718,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009715,"ip":"125.39.11.27","ts":"2026-05-30 19:41:31.000000","proto":"tcp","src_port":36160,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009696,"ip":"125.39.11.27","ts":"2026-05-30 19:41:19.000000","proto":"tcp","src_port":33610,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009680,"ip":"125.39.11.27","ts":"2026-05-30 19:41:08.000000","proto":"tcp","src_port":59296,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009667,"ip":"125.39.11.27","ts":"2026-05-30 19:40:58.000000","proto":"tcp","src_port":56746,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009653,"ip":"125.39.11.27","ts":"2026-05-30 19:40:48.000000","proto":"tcp","src_port":54190,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009636,"ip":"125.39.11.27","ts":"2026-05-30 19:40:38.000000","proto":"tcp","src_port":51642,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009626,"ip":"125.39.11.27","ts":"2026-05-30 19:40:29.000000","proto":"tcp","src_port":49094,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u002272e7e274744ef6316f0999494583700991061d45\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce_slow\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009614,"ip":"125.39.11.27","ts":"2026-05-30 19:40:19.000000","proto":"tcp","src_port":46546,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009594,"ip":"125.39.11.27","ts":"2026-05-30 19:40:10.000000","proto":"tcp","src_port":43994,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009582,"ip":"125.39.11.27","ts":"2026-05-30 19:40:01.000000","proto":"tcp","src_port":41446,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009572,"ip":"125.39.11.27","ts":"2026-05-30 19:39:53.000000","proto":"tcp","src_port":38900,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009560,"ip":"125.39.11.27","ts":"2026-05-30 19:39:45.000000","proto":"tcp","src_port":36354,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009551,"ip":"125.39.11.27","ts":"2026-05-30 19:39:36.000000","proto":"tcp","src_port":33804,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009539,"ip":"125.39.11.27","ts":"2026-05-30 19:39:28.000000","proto":"tcp","src_port":59484,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009532,"ip":"125.39.11.27","ts":"2026-05-30 19:39:20.000000","proto":"tcp","src_port":56936,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23},{"id":8009527,"ip":"125.39.11.27","ts":"2026-05-30 19:39:12.000000","proto":"tcp","src_port":54392,"dst_port":22,"service":"ssh","classification":"ssh_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 23, \u0022payload_entropy\u0022: 3.969001629875993, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022CHINA UNICOM China169 Backbone\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 4837, \u0022country\u0022: \u0022CN\u0022, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022risk_score\u0022: 78, \u0022campaign_key\u0022: \u00221c726010c9b4eaba318e270e818f08ec9ee5e0d9\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022tags_list\u0022: [\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_bruteforce\u0022, \u0022ssh_banner\u0022, \u0022ssh_libssh\u0022]","anomalies":"[]","severity":6,"bytes_in":23}],"total_events":77}