IT
15.557.039records yesterday
144.554distinct addresses
1017sensors reporting
last read

SANS Internet Storm Center · firewall logs from volunteer sensors · no geolocation

Yesterday 144.554 different addresses tried to get in somewhere.

This is not an attack map and it does not say who is attacking whom. It says something more modest and verifiable: which ports are being knocked on right now, how many distinct machines are trying, and how long the most persistent ones have been around.

What is knocking

bar scaled to distinct sources, not to records

All vulnerabilities →
23 Telnetplaintext remote access 4204sources CVE Telnet → 22 SSHencrypted remote access 4167sources CVE SSH → 443 HTTPSencrypted web 3345sources CVE HTTPS → 80 HTTPunencrypted web 2835sources CVE HTTP → 2222 Alternate SSHthe usual “hidden” port 2611sources CVE Alternate SSH → 8080 HTTP proxyconsoles and panels 1941sources CVE HTTP proxy →
8000 Alternate HTTPappliances and apps 1632sources —
16767 Unassignedno well-known service 1476sources —
8443 Alternate HTTPSmanagement consoles 1376sources CVE Alternate HTTPS →
9000 AssortedPHP-FPM, consoles, apps 1178sources —
51413 BitTorrentpeer-to-peer sharing 689sources —
137 Unassignedno well-known service 466sources —

Who has been at it longest

first and last sighting, from the sensors

AddressAttacksFirst seenActive for
185.94.111.1 7310 11 Sept 2021 5y 2m
66.240.205.34 4671 11 Sept 2021 5y 2m
80.82.77.33 4497 12 Sept 2021 5y 2m
80.82.77.139 4488 12 Sept 2021 5y 2m
167.94.145.27 4112 19 Nov 2021 4y 11m
167.94.145.29 4105 19 Nov 2021 4y 11m
167.94.145.25 4103 19 Nov 2021 4y 11m
167.94.145.16 4078 19 Nov 2021 4y 11m

Where the numbers come from All of it from isc.sans.edu, the SANS Internet Storm Center: firewall logs sent voluntarily by around a thousand sensors worldwide, aggregated and published through an open API with no key. None of the data is mine, none of it is estimated, and if the source does not answer this page shows zero rather than filler.

What this page does not say It does not say which country an attack comes from, nor who receives it: the source provides no geography, and deriving it from IP addresses would imply a precision that is not there. Maps drawing arcs between continents are almost always showing hits against their own publisher's sensors, presented as a live world war.