Who’s ssh’ing into my server?

Who’s ssh’ing into my server?

While doing some sunday maintenance on the digital ocean droplet that hosts this blog i noticed something creepy:

There were approximately 55k failed ssh login attempts for the root account.

This made me wonder:”where are these attacks coming from?”

So i threw together a quick and dirty python script to collate the ip’s, do a geo lookup on them, save this as a csv file, and finally use that in google fusion to create a heatmap.

You can watch the entire adventure here:

The code i made lives on github.

The droplet is on Digital Ocean.

And the heatmap was created in google fusion.

 

Leave a Reply

Your email address will not be published. Required fields are marked *