Pottr tracks SSH login attempts, external connections, and web probes to help you spot malicious IPs and attack patterns fast.
Use the map and charts below to explore recent activity — from the last few hours to the last 12 months. The buttons show what’s happened today since midnight.
Powered by cl0q, the free, independent search engine — going open source soon.
| Total SSH attempts | 3,196 |
| Distinct usernames | 43 |
| First seen | 2026-07-08 05:52 |
| Last seen | 2026-10-26 07:22 |
| Attacker IP | Username | Attempts | Last hit |
|---|---|---|---|
| 92.118.39.50 | apache | 154 | 07:22:46 |
| 144.225.187.181 | sysadmin | 2 | 07:22:11 |
| 80.94.92.179 | administrator | 296 | 07:21:31 |
| 193.46.255.86 | admin | 8,449 | 07:21:26 |
| 103.101.250.217 | notgoogle | 30 | 07:21:21 |
| 103.101.250.217 | ubuntu | 86 | 07:21:16 |
| 144.225.187.181 | server | 4 | 07:21:01 |
| 218.155.74.4 | notgoogle | 24 | 07:18:31 |
| 218.155.74.4 | ubuntu | 66 | 07:18:31 |
| 213.209.159.11 | ubuntu | 42 | 07:18:16 |
| 92.118.39.50 | administrator | 190 | 07:15:51 |
| 93.123.109.192 | pottr | 2,436 | 07:15:01 |
How SSH attack volume is changing over time — grouped by day, week, and month. Arrows compare the latest period with the one before it.
Which usernames attackers hammer most — a quick read on what they think this box is (note the crypto-wallet and cloud-image names).
37,115
last 7 hours183,047
last 7 hours2,089
last 7 hours