SSH attacks & scanning (port 22)
Secure Shell remote login — brute-force credential stuffing and client fingerprinting.
Observed by OffSeq honeypot sensors · last 30 days · #10 most-attacked service · last seen 12 minutes ago
173,616
Attacks
1,878
Distinct source IPs
22
Port · tcp
The #10 most-attacked service across the fleet in the last 30 days.
OffSeq honeypots emulating SSH recorded 173,616 attacks from 1,878 distinct source IPs over the last 30 days. Secure Shell remote login — brute-force credential stuffing and client fingerprinting.
Top CVEs exploited across the fleet (last 30 days)
Fleet-wide, not scoped to SSH.
- CVE-2017-01442,731
- CVE-2019-07082,655
- CVE-2024-45771,682
- CVE-2021-268551,652
- CVE-2017-9841542
- CVE-2025-5777269
- CVE-2023-3519150
- CVE-2012-212283