IT
18.918.043records yesterday
190.811distinct addresses
1099sensors reporting
last read

SANS Internet Storm Center · firewall logs from volunteer sensors · no geolocation

Yesterday 190.811 different addresses tried to get in somewhere.

This is not an attack map and it does not say who is attacking whom. It says something more modest and verifiable: which ports are being knocked on right now, how many distinct machines are trying, and how long the most persistent ones have been around.

What is knocking

bar scaled to distinct sources, not to records

All vulnerabilities →
23 Telnetplaintext remote access 9991sources CVE Telnet → 22 SSHencrypted remote access 8479sources CVE SSH → 80 HTTPunencrypted web 6577sources CVE HTTP → 443 HTTPSencrypted web 4038sources CVE HTTPS → 8080 HTTP proxyconsoles and panels 3834sources CVE HTTP proxy → 2222 Alternate SSHthe usual “hidden” port 3724sources CVE Alternate SSH →
8000 Alternate HTTPappliances and apps 3199sources —
16767 Unassignedno well-known service 2256sources —
9000 AssortedPHP-FPM, consoles, apps 1927sources —
123 NTPtime synchronisation 1456sources CVE NTP →
51413 BitTorrentpeer-to-peer sharing 1164sources —
25565 Minecraftgame server 160sources —

Where the numbers come from All of it from isc.sans.edu, the SANS Internet Storm Center: firewall logs sent voluntarily by around a thousand sensors worldwide, aggregated and published through an open API with no key. None of the data is mine, none of it is estimated, and if the source does not answer this page shows zero rather than filler.

What this page does not say It does not say which country an attack comes from, nor who receives it: the source provides no geography, and deriving it from IP addresses would imply a precision that is not there. Maps drawing arcs between continents are almost always showing hits against their own publisher's sensors, presented as a live world war.