UGB has a server. Whenever somebody fails to login he records their IP address. jamesgeo.com uses the IP location service from freegeoip.net to turn these IP addresses into locations.

Two maps showing failed logon attempts over a 37 day period. Note that the IP lookup’s locations may not be entirely accurate (note the cluster at 0, 0).

count_ssh_login_locations

All SSH login attempt locations, 17th Oct to 22nd Nov 2016.

count_ssh_100plus

Locations with 100 or more failed login attempts, 17th Oct to 22nd Nov.

Advertisements