# connections: of which login attempts
# hosts: , # clusters:
live data

Map

Last 250 hosts are displayed.

Legend: Connection established
Malicious host (passwords harvested)
Honeypot server Connected in the last 10 minutes Map controls:

Dark / streets · flat / globe view · center on the honeypot · activity by country

Honeypot Statistics

Login attempts per day (UTC)

New hosts first seen per day

Login attempts by hour (UTC, last 90 days)

One-time vs repeat

Top usernames

#	Username	Amount attempted

Top passwords

#	Password	Amount attempted

Top countries

#	Country	Amount of attempts

Top days

#	Top 20 days	Amount of attempts

Top organisations

#	Organisation	Login attempts	Hosts

Top attackers

#	Attacker	Login attempts	Connections	ASN / Organisation

Top credentials

#	User:Password combo	Attempts

We detect possible botnets by applying a 'Density-based spatial clustering of applications with noise (Jaccard similarity + MinHash LSH)' machine learning algorithms to the recorded distinct login sequences. Hosts listed here perform similar attacks. We omit botnets with less than 8 hosts recorded for a better overview.

Live attempt data

Displays detailed information about recent login attempts.

Last connection date (UTC)	IP address	Country	Organisation	Hostname	Username	Password

Mesa SSH Honeypot

About

Welcome to our SSH honeypot, where we provide insights into the world of cybersecurity by analyzing and presenting data collected from SSH honeypots. At our core, we're dedicated to understanding and mitigating the risks associated with unauthorized access attempts and malicious activities targeting SSH services.

What is an SSH Honeypot?

An SSH honeypot is a decoy system designed to lure in potential attackers who are scanning the internet for vulnerable SSH servers. This honeypot simulate real SSH services, logging connection attempts and interactions made by unauthorized users. By monitoring these interactions, we gain valuable insights into the tactics, techniques, and procedures employed by malicious actors.

Goal

Our goal is to leverage the data collected from SSH honeypots to enhance cybersecurity awareness and foster a safer online environment. We believe that by studying and understanding the behaviors of attackers, we can develop better strategies to defend against cyber threats and protect digital assets.

Contact Us

Have questions, feedback, or suggestions? We'd love to hear from you! Please don't hesitate to contact us.

Map