In today’s digital landscape, the threat of online attacks is a constant concern. My website, like many others, is a target for such threats. To address this, I've set up a system to monitor and display attempted intrusions against my servers.
Fans of DEFCON, a renowned cybersecurity conference, might be familiar with their 'Wall of Sheep' — a feature that showcases vulnerabilities in network traffic during the event. Drawing inspiration from this, I’ve created a similar display, but with a focus on attacks targeting my servers. It’s a daily testament to the diverse range of attacks we face, going beyond just website vulnerabilities to include attempts on all server ports.
The purpose of my 'Personalized Wall of Sheep' is educational. It serves as a live example of the relentless attacks servers endure, and aims to raise awareness among my visitors. This display is a vivid reminder that cyber threats are universal, affecting not just big corporations but every entity connected to the internet. It underscores the vital importance of cybersecurity for everyone.
Detected a total of 4,684 unique cyber attackers who, collectively, were responsible for 18,734 breach attempts.
(Each attacker is recorded once per day, regardless of the number of attempts)
To the right is a chart that illustrates the geographical distribution of the attacks against my servers. This chart categorizes each hacking attempt by its country of origin, providing visual insight into the diverse, global sources of these cyber intrusions.
It’s important to note, however, that geographical distribution can sometimes be masked using various techniques. Therefore, in instances where such masking was detected, these attackers have been reassigned to the category ‘obscured’ in the pie chart.
This chart breaks down the different kinds of traffic trying to access my network, focusing on whether the source is hidden or masked. It shows how attackers hide their identity using methods like VPNs, public proxies, or data centers.
This helps us understand the variety of ways attackers try to stay anonymous and the tactics they use to try to get past security measures.
The chart on the right showcases the top 20 data centers being used to launch attacks. These range from public cloud services to smaller providers.
This not only indicates the diversity of platforms used in cyber offensives but also suggests that many of these providers might be unaware of their infrastructure's misuse, highlighting a critical aspect of the cybersecurity challenge.
| IP | Country | Region | City | ISP | Ports | ||
|---|---|---|---|---|---|---|---|
 | 135.119.96.220 | United States | New York | New York City | Nokia of America Corporation | 5660 | System analysis reveals a focused attack on port 5660. |
 | 196.251.80.115 | Nigeria | Lagos | Lagos | Secure Internet Limited | 591, 585, 557, 503, 488, 477, 466, 464, 460, 454... (93 more) | System analysis reveals a focused approach on a handful of ports, such as 591, 585, 557. The attacker is behind the veil of a VPN. |
| 167.94.145.93 | United States | Michigan | Ann Arbor | Censys Inc. | 60429, 64861, 56478, 59018, 10913, 14709, 25725, 2815, 63510, 44927... (739 more) | Digital footprint reveals a focused approach on a handful of ports, such as 60429, 64861, 56478. The attacker is perhaps masquerading as a search engine bot? |
| 147.185.133.212 | United States | California | Santa Clara | Palo Alto Networks Inc | 9059, 994, 50921, 47683, 8840, 46865, 36963, 21315, 49415, 51997... (1024 more) | System analysis reveals a focused approach on a handful of ports, such as 9059, 994, 50921. The attacker appears to be leveraging a data center hideout. |
 | 112.165.118.35 | Korea (Republic of) | Gyeonggi-do | Seongnam | KT Corporation | 8010, 23 | System analysis reveals a selective approach targeting Telnet, and others. |
| 139.177.201.179 | United States | Georgia | Atlanta | Linode LLC | 44818, 8443 | Digital footprint reveals a selective approach targeting HTTPS, and others. The attacker appears to be leveraging a data center hideout. |
 | 45.141.233.28 | Germany | Hessen | Frankfurt am Main | Euro Crypt EOOD | 5902, 5901, 5900 | System analysis reveals a selective approach targeting VNC, and others. The attacker is behind the veil of a VPN. |
| 147.185.133.29 | United States | California | Santa Clara | Palo Alto Networks Inc | 8069, 45543, 48340, 489, 32402, 9725, 49415, 2077, 48284, 9362... (1009 more) | Activity shows a focused approach on a handful of ports, such as 8069, 45543, 48340. The attacker appears to be leveraging a data center hideout. |
| 100.29.192.84 | United States | Virginia | Ashburn | Amazon Data Services NoVa | 2375, 5601, 8089, 3306, 2022, 5672, 993, 873, 465, 25... (19 more) | System monitoring reveals a focused approach targeting MySQL, SMTP, and others. The attacker appears to be leveraging a data center hideout. |
 | 122.96.28.44 | China | Jiangsu | Nanjing | China Unicom Jiangsu Province Network | 1248, 27017 | Activity shows a selective approach targeting MongoDB, and others. The attacker appears to be leveraging a data center hideout. |
 | 196.251.118.87 | South Africa | Gauteng | Johannesburg | Secure Internet Limited | 27017 | Network inspection reveals a focused attack targeting MongoDB. The attacker is behind the veil of a VPN. |
| 198.235.24.254 | United States | California | Santa Clara | Palo Alto Networks Inc | 4430, 10250, 7070, 1911, 8020, 5222, 2080, 3690, 9001, 56222... (222 more) | Digital footprint reveals a focused approach on a handful of ports, such as 4430, 10250, 7070. The attacker appears to be leveraging a data center hideout. |
 | 91.196.152.187 | Ukraine | Kyiv | Kiev | Visteria LLC | 23581, 8805, 9029, 20090, 9534, 20119, 8702, 442, 17703, 32400... (59 more) | System monitoring reveals a focused approach on a handful of ports, such as 23581, 8805, 9029. The attacker appears to be leveraging a data center hideout. |
 | 152.52.85.138 | India | Delhi | Delhi | Bharti Airtel Ltd. | 445 | Digital footprint reveals a focused attack targeting SMB. |
| 146.190.75.249 | United States | New Jersey | North Bergen | DigitalOcean LLC | 32764, 1293, 9200 | Network inspection reveals a selective approach targeting Elasticsearch, and others. The attacker appears to be leveraging a data center hideout. |
| 115.28.77.246 | China | Shandong | Qingdao | Aliyun Computing Co. Ltd | 1433 | System analysis reveals a focused attack on port 1433. The attacker appears to be leveraging a data center hideout. |
 | 165.154.118.26 | Thailand | Krung Thep Maha Nakhon | Bangkok | UCloud Information Technology (HK) Limite... | 60008, 3725, 6417, 4016, 1482, 2019, 11186, 10215, 3204, 1279... (243 more) | System monitoring reveals a focused approach on a handful of ports, such as 60008, 3725, 6417. The attacker appears to be leveraging a data center hideout. |
| 198.235.24.46 | United States | California | Santa Clara | Palo Alto Networks Inc | 2604, 5903, 4430, 20123, 1200, 593, 50580, 21242, 4025, 50100... (214 more) | System analysis reveals a focused approach on a handful of ports, such as 2604, 5903, 4430. The attacker appears to be leveraging a data center hideout. |
| 45.144.212.201 | Ukraine | Kharkivska oblast | Kharkiv | Pitline Ltd | 587, 2525, 465, 25 | Network inspection reveals a selective approach targeting SMTP, and others. The attacker appears to be leveraging a data center hideout. |
 | 159.223.1.167 | Netherlands | Noord-Holland | Amsterdam | DigitalOcean LLC | 515, 306, 464, 340, 32, 1, 6, 110, 311, 81... (17 more) | System monitoring reveals a focused approach targeting POP3, and others. The attacker appears to be leveraging a data center hideout. |
| 167.94.146.19 | United States | Michigan | Ann Arbor | Censys Inc. | 18244, 11101, 1912, 250, 53282, 5222, 2403, 10260, 25565, 2405... (335 more) | System analysis reveals a focused approach on a handful of ports, such as 18244, 11101, 1912. The attacker is perhaps masquerading as a search engine bot? |
| 147.185.132.64 | United States | California | Santa Clara | Palo Alto Networks Inc | 5902, 5222, 43, 8800, 993, 593, 1344, 4018, 4444, 37443... (167 more) | Network inspection reveals a focused approach on a handful of ports, such as 5902, 5222, 43. The attacker appears to be leveraging a data center hideout. |
| 198.235.24.222 | United States | California | Santa Clara | Palo Alto Networks Inc | 10257, 3333, 2222, 8800, 110, 264, 2000, 5902, 8192, 8094... (235 more) | Activity shows a focused approach targeting POP3, and others. The attacker appears to be leveraging a data center hideout. |
| 198.235.24.226 | United States | California | Santa Clara | Palo Alto Networks Inc | 1234, 5902, 3917, 10000, 1604, 1112, 9001, 987, 1911, 1717... (233 more) | Digital footprint reveals a focused approach on a handful of ports, such as 1234, 5902, 3917. The attacker appears to be leveraging a data center hideout. |
 | 8.222.171.99 | Singapore | Singapore | Singapore | Alibaba.com Singapore E-Commerce Private ... | 22 | Digital footprint reveals a focused attack targeting SSH. The attacker appears to be leveraging a data center hideout. |