Threat Observatory

Delayed, privacy-reviewed findings from VardrSec's SSH and API decoys. The monthly SSH map shows qualifying public source addresses.

Observed source IP geography

Monthly SSH collection · UTC

IP table country Map metric

Waiting for the delayed monthly source collection.

Countries observed
Top country by login attempts
Top ASN by login attempts

No observationsLowModerateHighHighest

Larger circles show higher counts for the selected metric. Selecting a country highlights it on the map and filters the IP table.

Explore a country to see its activity.

Markers represent countries. Source IP locations can reflect proxies or hosting networks. IP Geolocation by DB-IP · Boundaries by Natural Earth

Observed source IPs

Select an IP to view its AbuseIPDB reputation and report history.

Source IP	Country	ASN	Login attempts

SSH activity

Past 24 complete hours

Observed sessions—Past 24 complete hours

Unique sources—Distinct connection sources

SSH authentication activity—Decoy-service observations

Activity and artifact counts cover the delayed 24-hour period. Latest snapshot —.

Session progression

Same delayed 24-hour period

— of sessions had command or file activity

Last observed stage	Sessions	Share

A stage is the last recorded event, not a reason the client disconnected.

Additional Cowrie events

Reported command successes: —
Reported command failures: —
SSH forwarding requests: —

Command results are separate decoy events; they do not add up to command inputs or prove host execution. A forwarding request is an attempt, not granted access.

Activity over time

Hourly UTC buckets

Loading activity statistics…

Other activity

Commands observed: —
File-transfer events: —

Observed attacker commands

Separate seven-day reporting period

Command / technique	Observations
Awaiting reviewed command statistics	—

Sanitized command patterns use a separate seven-day reporting period.

Observed artifacts

SHA-256 indicators

SHA-256	Observations	Analysis
No reviewed artifacts published yet	—	—

Since collection began

Historical totals

Historical totals are awaiting a delayed archive summary.

SSH connections—Recorded connection events

Commands observed—Attempts inside the decoy

File-transfer events—Repeated transfers count separately

Unique source addresses—Deduplicated across archived months

Unique captured hashes—Distinct files; not malware verdicts

Monthly Archive

Explore October 2026 map, activity and reviewed artifacts

Months use UTC. Partial periods cover only the available collection window. Counts can change as evidence is imported and reviewed.

Latest 12 months with archived observations · UTC
Month	Connections	Login attempts	Commands	File events	Unique source IPs
Monthly totals will appear with the historical summary.

Partial months are marked.

API sensor research

Awaiting published data

Public observations appear after a complete delayed reporting period and a reviewed snapshot.

No reviewed API observations have been published yet. This section will show request patterns, methods and claimed tool families when data is available.

API requests—Separate 24-hour period

Authentication probes—Attempts, not successful access

Schema discovery—OpenAPI and related requests

Data access probes—Requests to simulated resources

Observed request runs

Same delayed 24-hour period

Request runs—Grouped by source and time gap

Multi-request runs—Two or more requests

API-route runs—At least one named API category

Mixed-category runs—More than one fixed category

Last observed request category

Per request run

Category	Runs

A run groups requests from one source address with gaps of up to 30 minutes. Addresses can be shared or proxied, and reporting-window edges can split runs. The last observed request does not establish why activity ended.

Request and client signals

Fixed labels; no raw request data

Observed request patterns

Fixed research categories

Pattern	Requests
Awaiting live observations	—

HTTP methods

Aggregated counts

Method	Requests
Awaiting live observations	—

Self-reported client tools

User-Agent family labels

Claimed tool family	Requests
Awaiting live observations	—

User-Agent strings are easy to spoof. These fixed labels are hints about tooling, not bot identity or reliable fingerprints. Raw headers are not retained.

The API decoy returns fixed responses. Counts describe requests, not authenticated access, executed payloads, or host compromise. Source addresses, credentials, query strings, request bodies and raw paths are never displayed.

Methodology and limitations

The data comes from honeypots: decoy services that record what automated attackers try. Activity inside a decoy does not mean a real host was compromised.
Monthly geography lists public source IPs with observed SSH login attempts after a publication delay. Country and ASN estimates describe the network endpoint. Credentials and private session details stay out of public snapshots.
Command patterns are sanitized templates from the reporting period shown with the table. They record attempts, not successful execution, and redaction markers are not executable.
Reviewed SHA-256 hashes link to VirusTotal (external site). A hash is not a malware verdict, and captured files are never uploaded automatically.
Historical totals come from one sensor, not global attack activity. They are kept separately from the 30-day detailed-event retention, and closed months can still have collection gaps or late arrivals.