Attack data, measured on a real server
LogTriage's production server is an ordinary cloud machine on the internet, not a honeypot. Every month we publish what reached it, in aggregates only: no individual address is ever listed. The data is free to reuse under CC BY 4.0.
Monthly · latest September 2026
What attacks an internet-facing server
- Failed SSH logins
- 239,750
- Addresses behind them
- 1,612
6 Sep – 5 Oct 2026 · SSH brute force, web probes, countries and networks
Read the report →Monthly · latest October 2026
Free IP blocklists against real attackers
- Attackers measured
- 7,110
- Traffic on the best list
- 84%
IPsum (on 1+ lists) caught the most; 17 free lists and AbuseIPDB's top 10,000 compared
Read the study →