Factory_Server_was_br_Hacked

We received an urgent notification from our Intrusion Detection System (IDS) indicating that an unknown IP address appeared in our login logs. To investigate, we asked the administrator to run the 'last -100' command on the Linux server in our factory. The 'last' command provides a list of users who have previously logged into the system and is particularly useful for system administrators tracking user activity. Could you please locate the IP address the hacker used in the last_login.log file so that we can report the SSH Brute Force attack to https://www.abuseipdb.com/ We believe it may have already been reported. We need to identify the specific username that was targeted in the brute force attack, leading to unauthorized access by the hacker. FLAG is the compromised Username NOT the attacker IP Address