SSH attacks & scanning (port 22)
Secure Shell remote login — brute-force credential stuffing and client fingerprinting.
Observed by OffSeq honeypot sensors · last 7 days · #11 most-attacked service · last seen 2 minutes ago
16,260
Attacks
922
Distinct source IPs
22
Port · tcp
The #11 most-attacked service across the fleet in the last 7 days.
OffSeq honeypots emulating SSH recorded 16,260 attacks from 922 distinct source IPs over the last 7 days. Secure Shell remote login — brute-force credential stuffing and client fingerprinting.
Top CVEs exploited across the fleet (last 7 days)
Fleet-wide, not scoped to SSH.
- CVE-2019-0708501
- CVE-2021-26855482
- CVE-2024-4577482
- CVE-2017-9841402
- CVE-2017-0144252
- CVE-2025-324890