{
  "schema_version": 1,
  "edition": "2026-10",
  "generated_at": "2026-10-24T04:12:17Z",
  "feeds_downloaded_at": "2026-10-24T04:12:07Z",
  "server": "LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443",
  "key_only_since": "2026-10-06",
  "period": {
    "kind": "last_days",
    "start": "2026-09-24T00:00:00Z",
    "end": "2026-10-24T00:00:00Z",
    "days": 30
  },
  "coverage": {
    "ssh": {
      "source": "systemd journal (ssh.service)",
      "start": "2026-09-24T00:00:00Z",
      "end": "2026-10-24T00:00:00Z",
      "days": 30,
      "complete": true
    },
    "http": {
      "source": "nginx access log",
      "start": "2026-09-24T00:00:00Z",
      "end": "2026-10-24T00:00:00Z",
      "days": 30,
      "complete": true,
      "files": 32
    }
  },
  "attackers": {
    "ssh_sources": 3727,
    "ssh_connections": 136441,
    "http_sources": 3596,
    "http_requests": 61271,
    "all_sources": 7110,
    "both_channels": 213,
    "heavy_hitters": 100
  },
  "feeds": [
    {
      "id": "ipsum-1",
      "label": "IPsum (on 1+ lists)",
      "family": "ipsum",
      "homepage": "https://github.com/stamparm/ipsum",
      "download": "https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt",
      "about": "Daily aggregate of 30+ public blocklists; every address with the number of lists naming it.",
      "license": "Unlicense (public domain)",
      "republishable": true,
      "error": null,
      "entries": 128244,
      "addresses_v4": 128244,
      "ssh": {
        "sources": 2400,
        "source_share": 0.6439,
        "event_share": 0.8726
      },
      "http": {
        "sources": 2471,
        "source_share": 0.6872,
        "event_share": 0.7714
      },
      "all": {
        "sources": 4673,
        "source_share": 0.6572,
        "event_share": 0.8412
      },
      "heavy_hitters_share": 0.9,
      "unique_sources": 1071,
      "unique_share": 0.1506
    },
    {
      "id": "ipsum-3",
      "label": "IPsum level 3 (on 3+ lists)",
      "family": "ipsum",
      "homepage": "https://github.com/stamparm/ipsum",
      "download": "https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt",
      "about": "IPsum addresses named by at least 3 lists — the project's suggested blocking level.",
      "license": "Unlicense (public domain)",
      "republishable": true,
      "error": null,
      "entries": 19670,
      "addresses_v4": 19670,
      "ssh": {
        "sources": 1774,
        "source_share": 0.476,
        "event_share": 0.7305
      },
      "http": {
        "sources": 1317,
        "source_share": 0.3662,
        "event_share": 0.4764
      },
      "all": {
        "sources": 2930,
        "source_share": 0.4121,
        "event_share": 0.6518
      },
      "heavy_hitters_share": 0.73
    },
    {
      "id": "ipsum-5",
      "label": "IPsum level 5 (on 5+ lists)",
      "family": "ipsum",
      "homepage": "https://github.com/stamparm/ipsum",
      "download": "https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt",
      "about": "IPsum addresses named by at least 5 lists.",
      "license": "Unlicense (public domain)",
      "republishable": true,
      "error": null,
      "entries": 5289,
      "addresses_v4": 5289,
      "ssh": {
        "sources": 1186,
        "source_share": 0.3182,
        "event_share": 0.3721
      },
      "http": {
        "sources": 479,
        "source_share": 0.1332,
        "event_share": 0.228
      },
      "all": {
        "sources": 1550,
        "source_share": 0.218,
        "event_share": 0.3274
      },
      "heavy_hitters_share": 0.41
    },
    {
      "id": "firehol-level1",
      "label": "FireHOL level 1",
      "family": "firehol-level1",
      "homepage": "https://iplists.firehol.org/?ipset=firehol_level1",
      "download": "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset",
      "about": "Networks FireHOL considers safe to block outright: bogons, Spamhaus DROP/EDROP, DShield, Feodo.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 4638,
      "addresses_v4": 611046273,
      "ssh": {
        "sources": 460,
        "source_share": 0.1234,
        "event_share": 0.5735
      },
      "http": {
        "sources": 538,
        "source_share": 0.1496,
        "event_share": 0.4113
      },
      "all": {
        "sources": 924,
        "source_share": 0.13,
        "event_share": 0.5232
      },
      "heavy_hitters_share": 0.78,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "firehol-level2",
      "label": "FireHOL level 2",
      "family": "firehol-level2",
      "homepage": "https://iplists.firehol.org/?ipset=firehol_level2",
      "download": "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset",
      "about": "Addresses seen attacking in roughly the last 48 hours (blocklist.de, GreenSnow, DShield and others).",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 22151,
      "addresses_v4": 40499,
      "ssh": {
        "sources": 1644,
        "source_share": 0.4411,
        "event_share": 0.756
      },
      "http": {
        "sources": 884,
        "source_share": 0.2458,
        "event_share": 0.5586
      },
      "all": {
        "sources": 2397,
        "source_share": 0.3371,
        "event_share": 0.6948
      },
      "heavy_hitters_share": 0.82,
      "unique_sources": 7,
      "unique_share": 0.001
    },
    {
      "id": "firehol-level3",
      "label": "FireHOL level 3",
      "family": "firehol-level3",
      "homepage": "https://iplists.firehol.org/?ipset=firehol_level3",
      "download": "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset",
      "about": "Addresses seen attacking in roughly the last 30 days.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 10510,
      "addresses_v4": 32594,
      "ssh": {
        "sources": 628,
        "source_share": 0.1685,
        "event_share": 0.3119
      },
      "http": {
        "sources": 1360,
        "source_share": 0.3782,
        "event_share": 0.333
      },
      "all": {
        "sources": 1868,
        "source_share": 0.2627,
        "event_share": 0.3184
      },
      "heavy_hitters_share": 0.56,
      "unique_sources": 19,
      "unique_share": 0.0027
    },
    {
      "id": "spamhaus-drop",
      "label": "Spamhaus DROP",
      "family": "spamhaus-drop",
      "homepage": "https://www.spamhaus.org/blocklists/do-not-route-or-peer/",
      "download": "https://www.spamhaus.org/drop/drop_v4.json",
      "about": "Netblocks hijacked or leased by professional spam and cybercrime operations.",
      "license": "Free, commercial use included; credit Spamhaus and keep its date and © notice",
      "republishable": false,
      "error": null,
      "entries": 1688,
      "addresses_v4": 14917632,
      "ssh": {
        "sources": 213,
        "source_share": 0.0572,
        "event_share": 0.4003
      },
      "http": {
        "sources": 240,
        "source_share": 0.0667,
        "event_share": 0.3903
      },
      "all": {
        "sources": 427,
        "source_share": 0.0601,
        "event_share": 0.3972
      },
      "heavy_hitters_share": 0.47,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "blocklist-de-all",
      "label": "blocklist.de (all)",
      "family": "blocklist-de",
      "homepage": "https://www.blocklist.de/en/export.html",
      "download": "https://lists.blocklist.de/lists/all.txt",
      "about": "Addresses reported by fail2ban and similar sensors in the last 48 hours, all services.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 27594,
      "addresses_v4": 27052,
      "ssh": {
        "sources": 1212,
        "source_share": 0.3252,
        "event_share": 0.6688
      },
      "http": {
        "sources": 256,
        "source_share": 0.0712,
        "event_share": 0.4213
      },
      "all": {
        "sources": 1416,
        "source_share": 0.1992,
        "event_share": 0.5921
      },
      "heavy_hitters_share": 0.67,
      "unique_sources": 2,
      "unique_share": 0.0003
    },
    {
      "id": "blocklist-de-ssh",
      "label": "blocklist.de (SSH)",
      "family": "blocklist-de",
      "homepage": "https://www.blocklist.de/en/export.html",
      "download": "https://lists.blocklist.de/lists/ssh.txt",
      "about": "blocklist.de's SSH attackers only.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 4892,
      "addresses_v4": 4874,
      "ssh": {
        "sources": 1162,
        "source_share": 0.3118,
        "event_share": 0.5969
      },
      "http": {
        "sources": 85,
        "source_share": 0.0236,
        "event_share": 0.0189
      },
      "all": {
        "sources": 1217,
        "source_share": 0.1712,
        "event_share": 0.4178
      },
      "heavy_hitters_share": 0.46
    },
    {
      "id": "cins-army",
      "label": "CINS Army",
      "family": "cins-army",
      "homepage": "https://cinsscore.com/",
      "download": "https://cinsscore.com/list/ci-badguys.txt",
      "about": "Sentinel IPS's list of addresses with poor reputation scores.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 15000,
      "addresses_v4": 15000,
      "ssh": {
        "sources": 256,
        "source_share": 0.0687,
        "event_share": 0.004
      },
      "http": {
        "sources": 939,
        "source_share": 0.2611,
        "event_share": 0.0968
      },
      "all": {
        "sources": 1141,
        "source_share": 0.1605,
        "event_share": 0.0328
      },
      "heavy_hitters_share": 0.01,
      "unique_sources": 1,
      "unique_share": 0.0001
    },
    {
      "id": "greensnow",
      "label": "GreenSnow",
      "family": "greensnow",
      "homepage": "https://greensnow.co/",
      "download": "https://blocklist.greensnow.co/greensnow.txt",
      "about": "Addresses caught attacking GreenSnow's honeypots.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 5359,
      "addresses_v4": 5359,
      "ssh": {
        "sources": 883,
        "source_share": 0.2369,
        "event_share": 0.2736
      },
      "http": {
        "sources": 101,
        "source_share": 0.0281,
        "event_share": 0.1232
      },
      "all": {
        "sources": 964,
        "source_share": 0.1356,
        "event_share": 0.227
      },
      "heavy_hitters_share": 0.19,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "binary-defense",
      "label": "Binary Defense banlist",
      "family": "binary-defense",
      "homepage": "https://www.binarydefense.com/",
      "download": "https://www.binarydefense.com/banlist.txt",
      "about": "Binary Defense's Artillery threat intelligence feed.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 1145,
      "addresses_v4": 1145,
      "ssh": {
        "sources": 119,
        "source_share": 0.0319,
        "event_share": 0.1221
      },
      "http": {
        "sources": 159,
        "source_share": 0.0442,
        "event_share": 0.0767
      },
      "all": {
        "sources": 240,
        "source_share": 0.0338,
        "event_share": 0.108
      },
      "heavy_hitters_share": 0.2,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "et-compromised",
      "label": "Emerging Threats compromised IPs",
      "family": "et-compromised",
      "homepage": "https://rules.emergingthreats.net/",
      "download": "https://rules.emergingthreats.net/blockrules/compromised-ips.txt",
      "about": "Proofpoint ET's list of known compromised hosts.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 482,
      "addresses_v4": 482,
      "ssh": {
        "sources": 92,
        "source_share": 0.0247,
        "event_share": 0.0457
      },
      "http": {
        "sources": 20,
        "source_share": 0.0056,
        "event_share": 0.01
      },
      "all": {
        "sources": 99,
        "source_share": 0.0139,
        "event_share": 0.0346
      },
      "heavy_hitters_share": 0.05,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "dshield-top20",
      "label": "DShield top 20 networks",
      "family": "dshield-top20",
      "homepage": "https://isc.sans.edu/block.html",
      "download": "https://feeds.dshield.org/block.txt",
      "about": "The 20 /24 networks SANS ISC's sensors saw attacking most in the last three days.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 20,
      "addresses_v4": 5120,
      "ssh": {
        "sources": 245,
        "source_share": 0.0657,
        "event_share": 0.1814
      },
      "http": {
        "sources": 366,
        "source_share": 0.1018,
        "event_share": 0.0245
      },
      "all": {
        "sources": 562,
        "source_share": 0.079,
        "event_share": 0.1328
      },
      "heavy_hitters_share": 0.32,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "tor-exits",
      "label": "Tor exit nodes",
      "family": "tor-exits",
      "homepage": "https://check.torproject.org/",
      "download": "https://check.torproject.org/torbulkexitlist",
      "about": "Current Tor exit relays — not attackers by definition; a measure of how much attack traffic used Tor.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 1218,
      "addresses_v4": 1218,
      "ssh": {
        "sources": 0,
        "source_share": 0,
        "event_share": 0
      },
      "http": {
        "sources": 3,
        "source_share": 0.0008,
        "event_share": 0.0005
      },
      "all": {
        "sources": 3,
        "source_share": 0.0004,
        "event_share": 0.0001
      },
      "heavy_hitters_share": 0,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "feodo",
      "label": "Feodo Tracker botnet C2",
      "family": "feodo",
      "homepage": "https://feodotracker.abuse.ch/blocklist/",
      "download": "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
      "about": "Botnet command-and-control servers (Dridex, Emotet, QakBot successors). A C2 list, not a scanner list.",
      "license": "CC0 (abuse.ch), commercial use included",
      "republishable": true,
      "error": null,
      "entries": 5,
      "addresses_v4": 5,
      "ssh": {
        "sources": 0,
        "source_share": 0,
        "event_share": 0
      },
      "http": {
        "sources": 0,
        "source_share": 0,
        "event_share": 0
      },
      "all": {
        "sources": 0,
        "source_share": 0,
        "event_share": 0
      },
      "heavy_hitters_share": 0,
      "unique_sources": 0,
      "unique_share": 0
    },
    {
      "id": "abuseipdb-top10k",
      "label": "AbuseIPDB blacklist (top 10,000)",
      "family": "abuseipdb",
      "homepage": "https://www.abuseipdb.com/",
      "download": "https://api.abuseipdb.com/api/v2/blacklist",
      "about": "AbuseIPDB's free-plan blacklist: the 10,000 most reported addresses at 100% abuse confidence (needs a free account and API key).",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 10000,
      "addresses_v4": 9972,
      "ssh": {
        "sources": 892,
        "source_share": 0.2393,
        "event_share": 0.4303
      },
      "http": {
        "sources": 541,
        "source_share": 0.1504,
        "event_share": 0.2663
      },
      "all": {
        "sources": 1356,
        "source_share": 0.1907,
        "event_share": 0.3795
      },
      "heavy_hitters_share": 0.41,
      "unique_sources": 10,
      "unique_share": 0.0014
    },
    {
      "id": "logtriage-builtin",
      "label": "LogTriage built-in ranges",
      "family": "logtriage",
      "homepage": "https://logtriage.app/",
      "download": null,
      "about": "The ranges LogTriage itself scores against: Spamhaus DROP, FireHOL level 1 and ranges from confirmed incidents.",
      "license": null,
      "republishable": false,
      "error": null,
      "entries": 5185,
      "addresses_v4": null,
      "ssh": {
        "sources": 521,
        "source_share": 0.1398,
        "event_share": 0.5798
      },
      "http": {
        "sources": 717,
        "source_share": 0.1994,
        "event_share": 0.4199
      },
      "all": {
        "sources": 1144,
        "source_share": 0.1609,
        "event_share": 0.5302
      },
      "heavy_hitters_share": 0.79
    }
  ],
  "unlisted": {
    "sources": 2319,
    "source_share": 0.3262,
    "event_share": 0.0838,
    "heavy_hitters_share": 0.02
  },
  "combinations": [
    {
      "feeds": [
        "ipsum-1"
      ],
      "source_share": 0.6572,
      "event_share": 0.8412
    },
    {
      "feeds": [
        "ipsum-1",
        "firehol-level1"
      ],
      "source_share": 0.6662,
      "event_share": 0.9131
    },
    {
      "feeds": [
        "ipsum-1",
        "firehol-level1",
        "firehol-level2"
      ],
      "source_share": 0.6678,
      "event_share": 0.9153
    }
  ],
  "notes": [
    "Feeds were downloaded when the report ran, after the window: a list that adds attackers quickly and keeps them for weeks scores higher than one that would have blocked them before their first attempt.",
    "Bigger lists catch more and also risk blocking legitimate addresses; an attacked server cannot measure that side, so weigh coverage against list size.",
    "SSH is counted in pre-authentication connections: the server has accepted keys only since 2026-10-06, so password failures no longer measure attack volume."
  ]
}