Pottr tracks SSH login attempts, external connections, and web probes to help you spot malicious IPs and attack patterns fast.
Use the map and charts below to explore the last 7 days of activity. The buttons show what’s happened today since midnight.
| Total SSH attempts | 3,254 |
| Distinct usernames | 552 |
| First seen | 2026-09-05 18:26 |
| Last seen | 2026-09-20 08:27 |
| Attacker IP | Username | Attempts | Last hit |
|---|---|---|---|
| 109.160.32.24 | hadoop | 4 | 08:27:54 |
| 5.250.178.238 | server | 78 | 08:27:48 |
| 109.160.32.24 | root1 | 10 | 08:27:33 |
| 109.160.32.24 | rdpuser | 8 | 08:27:23 |
| 109.160.32.24 | webadmin | 6 | 08:27:13 |
| 93.123.109.192 | pottr | 1,618 | 08:27:08 |
| 109.160.32.24 | ubuntu | 72 | 08:27:03 |
| 109.160.32.24 | admin | 48 | 08:26:58 |
| 109.160.32.24 | test | 30 | 08:26:53 |
| 109.160.32.24 | fastuser | 12 | 08:26:43 |
| 109.160.32.24 | tomcat | 2 | 08:26:18 |
| 172.174.5.146 | tommy | 4 | 08:26:13 |
How SSH attack volume is changing over time — grouped by day, week, and month. Arrows compare the latest period with the one before it.
Which usernames attackers hammer most — a quick read on what they think this box is (note the crypto-wallet and cloud-image names).
25789
last 7 days71709
last 7 days1020
last 7 days