Observed over the last 31 days.
Public threat snapshot
SSH attack activity
observed by Sarang.
This public portal uses daily JSON updates for fast situational awareness, regional context, and accessible IoC discovery.
Distinct sources in the reporting window.
Sessions progressing beyond failed attempts.
Interactive commands captured after access.
Observed payload delivery activity.
Distinct hashes from download activity.
Attack activity
SSH Attacks Trend Yesterday
Attack activity
SSH Attacks Trend
Global focus
Global Source Context
Global Countries by Unique IPs
Top 10 countries by unique source IPs.
Attack Volume by Global Countries
Top 10 countries by total observed activity.
Regional focus · Southeast Asia
Regional Source Context
SEA Countries by Unique IPs
Regional countries ranked by unique source IPs.
Attack Volume by Regional Countries
Regional countries ranked by total observed activity.
Top observables
Top 10 Attacker IPs
Higher event counts indicate more observed activity, not confirmed attribution to one actor.
Loading published observations…
Top observables
Top 10 Malicious Score IPs
The score is a behaviour-based proxy weighted from observed Cowrie activity. It is not a native threat-intelligence reputation score.
Loading published observations…
Interpretation notice
Public indicators reflect activity seen by Sarang only.
Observed IP addresses and hashes support threat awareness but should not be treated as identity attribution on their own. Evaluate indicators in context before using them for automated blocking.