Pottr tracks SSH login attempts, external connections, and web probes to help you spot malicious IPs and attack patterns fast.
Use the map and charts below to explore the last 7 days of activity. The buttons show what’s happened today since midnight.
| Total SSH attempts | 344 |
| Distinct usernames | 125 |
| First seen | 2026-09-14 02:28 |
| Last seen | 2026-09-14 03:12 |
| Attacker IP | Username | Attempts | Last hit |
|---|---|---|---|
| 77.239.124.211 | nxt | 2 | 03:12:43 |
| 77.239.124.211 | ranga | 2 | 03:12:33 |
| 77.239.124.211 | user | 10 | 03:12:23 |
| 2.57.122.238 | bot | 506 | 03:12:19 |
| 77.239.124.211 | public | 2 | 03:12:08 |
| 77.239.124.211 | n8n | 2 | 03:11:58 |
| 106.251.244.178 | admin | 20 | 03:11:53 |
| 103.28.38.126 | cl0q | 26 | 03:11:49 |
| 103.28.38.126 | ubuntu | 56 | 03:11:48 |
| 14.46.87.209 | student02 | 2 | 03:11:38 |
| 42.117.2.215 | cl0q | 38 | 03:11:34 |
| 42.117.2.215 | ubuntu | 118 | 03:11:33 |
How SSH attack volume is changing over time — grouped by day, week, and month. Arrows compare the latest period with the one before it.
Which usernames attackers hammer most — a quick read on what they think this box is (note the crypto-wallet and cloud-image names).
18965
last 7 days79880
last 7 days1228
last 7 days