Wall of Sheep

wall of sheep

In today’s digital landscape, the threat of online attacks is a constant concern. My website, like many others, is a target for such threats. To address this, I've set up a system to monitor and display attempted intrusions against my servers.

Fans of DEFCON, a renowned cybersecurity conference, might be familiar with their 'Wall of Sheep' — a feature that showcases vulnerabilities in network traffic during the event. Drawing inspiration from this, I’ve created a similar display, but with a focus on attacks targeting my servers. It’s a daily testament to the diverse range of attacks we face, going beyond just website vulnerabilities to include attempts on all server ports.

The purpose of my 'Personalized Wall of Sheep' is educational. It serves as a live example of the relentless attacks servers endure, and aims to raise awareness among my visitors. This display is a vivid reminder that cyber threats are universal, affecting not just big corporations but every entity connected to the internet. It underscores the vital importance of cybersecurity for everyone.

In the Last 24 Hours

Detected a total of 4,430 unique cyber attackers who, collectively, were responsible for 18,721 breach attempts.

Unique Cyber Attackers - Last 14 Days

(Each attacker is recorded once per day, regardless of the number of attempts)

To the right is a chart that illustrates the geographical distribution of the attacks against my servers. This chart categorizes each hacking attempt by its country of origin, providing visual insight into the diverse, global sources of these cyber intrusions.

It’s important to note, however, that geographical distribution can sometimes be masked using various techniques. Therefore, in instances where such masking was detected, these attackers have been reassigned to the category ‘obscured’ in the pie chart.

This chart breaks down the different kinds of traffic trying to access my network, focusing on whether the source is hidden or masked. It shows how attackers hide their identity using methods like VPNs, public proxies, or data centers.

This helps us understand the variety of ways attackers try to stay anonymous and the tactics they use to try to get past security measures.

The chart on the right showcases the top 20 data centers being used to launch attacks. These range from public cloud services to smaller providers.

This not only indicates the diversity of platforms used in cyber offensives but also suggests that many of these providers might be unaware of their infrastructure's misuse, highlighting a critical aspect of the cybersecurity challenge.

Attackers over the last 24 hours

The most recent 25 attackers

IPCountryRegionCityISPPorts
United States flag
206.168.34.134United StatesMichiganAnn ArborCensys Inc.57382, 62217, 14493, 14848, 46330, 25084, 27544, 35504, 64318, 46226... (746 more)
Activity shows a focused approach on a handful of ports, such as 57382, 62217, 14493. The attacker is perhaps masquerading as a search engine bot?
United Kingdom flag
35.203.211.250United KingdomEnglandLondonGoogle LLC5601, 2280, 8043, 5012, 9678, 1808, 221, 8188, 46364, 18778... (1311 more)
Digital footprint reveals a focused approach on a handful of ports, such as 5601, 2280, 8043. The attacker appears to be leveraging a data center hideout.
Netherlands flag
185.242.226.39NetherlandsNoord-HollandAmsterdamAlsycon B.V.5566, 5498, 5480, 6005, 6004, 5858, 5481, 5321, 5569, 5150... (149 more)
Activity shows a focused approach on a handful of ports, such as 5566, 5498, 5480. The attacker appears to be leveraging a data center hideout.
United Kingdom flag
35.203.211.199United KingdomEnglandLondonGoogle LLC19000, 10555, 9719, 9556, 8139, 6973, 22086, 34926, 33950, 27017... (1367 more)
System analysis reveals a focused approach targeting MongoDB, and others. The attacker appears to be leveraging a data center hideout.
United Kingdom flag
35.203.210.47United KingdomEnglandLondonGoogle LLC9949, 9322, 7789, 48523, 48731, 28094, 48620, 46615, 47434, 61443... (1370 more)
Activity shows a focused approach on a handful of ports, such as 9949, 9322, 7789. The attacker appears to be leveraging a data center hideout.
United Kingdom flag
35.203.211.93United KingdomEnglandLondonGoogle LLC9403, 9942, 28020, 46711, 48239, 47387, 54039, 42258, 47885, 7158... (1338 more)
Network inspection reveals a focused approach on a handful of ports, such as 9403, 9942, 28020. The attacker appears to be leveraging a data center hideout.
United States flag
205.210.31.209United StatesCaliforniaSanta ClaraPalo Alto Networks Inc51200, 9600, 10011, 4025, 139, 8999, 4911, 5909, 8020, 8085... (206 more)
Network inspection reveals a focused approach targeting NetBIOS, and others. The attacker appears to be leveraging a data center hideout.
United States flag
198.235.24.101United StatesCaliforniaSanta ClaraPalo Alto Networks Inc2455, 18574, 2484, 3306, 25789, 23, 51005, 3443, 83, 2379... (188 more)
System analysis reveals a focused approach targeting MySQL, Telnet, and others. The attacker appears to be leveraging a data center hideout.
United States flag
45.33.105.76United StatesCaliforniaFremontAkamai Technologies Inc.6172, 3265, 8123, 8069, 8822, 7744, 8887, 64443, 49671, 50806... (1085 more)
Digital footprint reveals a focused approach on a handful of ports, such as 6172, 3265, 8123. The attacker appears to be leveraging a data center hideout.
United States flag
13.87.242.23United StatesCaliforniaSan FranciscoMicrosoft Corporation4369, 162, 514, 8009, 22, 2096, 8889, 8086, 4848, 264... (30 more)
Activity shows a focused approach targeting SSH, and others. The attacker appears to be leveraging a data center hideout.
United States flag
147.185.132.77United StatesCaliforniaSanta ClaraPalo Alto Networks Inc9532, 46056, 49951, 49304, 2098, 8547, 9878, 23000, 9913, 9898... (712 more)
Network inspection reveals a focused approach on a handful of ports, such as 9532, 46056, 49951. The attacker appears to be leveraging a data center hideout.
Japan flag
49.243.91.150JapanTokyoTokyoFreebit Co. Ltd.67
Network inspection reveals a focused attack on port 67.
Germany flag
8.211.42.24GermanyHessenFrankfurt am MainAlibaba.com Singapore E-Commerce Private ...9007, 2010, 18070, 9505, 5985, 8882, 8252, 9284, 800, 5569... (48 more)
Network inspection reveals a focused approach on a handful of ports, such as 9007, 2010, 18070. The attacker appears to be leveraging a data center hideout.
United Kingdom flag
35.203.210.103United KingdomEnglandLondonGoogle LLC22117, 45128, 48810, 49950, 56907, 45909, 9702, 32795, 9515, 7771... (1312 more)
Activity shows a focused approach on a handful of ports, such as 22117, 45128, 48810. The attacker appears to be leveraging a data center hideout.
Korea (Republic of) flag
20.194.60.135Korea (Republic of)Seoul-teukbyeolsiSeoulMicrosoft Corporation22
Network inspection reveals a focused attack targeting SSH. The attacker appears to be using a public proxy.
Viet Nam flag
103.164.139.165Viet NamHo Chi MinhHo Chi Minh CityCloudcore Joint Stock Company22
Activity shows a focused attack targeting SSH. The attacker appears to be leveraging a data center hideout.
United States flag
162.216.150.184United StatesSouth CarolinaNorth CharlestonGoogle LLC8045, 8098, 9307, 9806, 9349, 8831, 32126, 9838, 9525, 46522... (1383 more)
System monitoring reveals a focused approach on a handful of ports, such as 8045, 8098, 9307. The attacker appears to be leveraging a data center hideout.
United States flag
198.235.24.209United StatesCaliforniaSanta ClaraPalo Alto Networks Inc21242, 81, 1080, 1801, 7443, 2087, 771, 4100, 25565, 7777... (205 more)
Network inspection reveals a focused approach on a handful of ports, such as 21242, 81, 1080. The attacker appears to be leveraging a data center hideout.
United Kingdom flag
35.203.211.249United KingdomEnglandLondonGoogle LLC49420, 9566, 4569, 48609, 46625, 50012, 48132, 8614, 35810, 45076... (1370 more)
Network inspection reveals a focused approach on a handful of ports, such as 49420, 9566, 4569. The attacker appears to be leveraging a data center hideout.
United States flag
162.216.150.55United StatesSouth CarolinaNorth CharlestonGoogle LLC11001, 38078, 45842, 9471, 9175, 24343, 3973, 36510, 3001, 46555... (1358 more)
Digital footprint reveals a focused approach on a handful of ports, such as 11001, 38078, 45842. The attacker appears to be leveraging a data center hideout.
United States flag
172.168.41.9United StatesIowaDes MoinesMicrosoft Limited8834, 11740, 123, 28015, 5902, 7001, 9042, 5631, 8889, 8087... (32 more)
System monitoring reveals a focused approach on a handful of ports, such as 8834, 11740, 123. The attacker appears to be leveraging a data center hideout.
Indonesia flag
103.172.204.189IndonesiaBantenTangerangPT Cloud Hosting Indonesia22
Activity shows a focused attack targeting SSH. The attacker appears to be leveraging a data center hideout.
United Kingdom flag
35.203.211.30United KingdomEnglandLondonGoogle LLC22998, 8165, 5985, 47487, 5122, 5011, 34425, 9166, 5100, 4413... (1410 more)
Network inspection reveals a focused approach on a handful of ports, such as 22998, 8165, 5985. The attacker appears to be leveraging a data center hideout.
United States flag
205.210.31.206United StatesCaliforniaSanta ClaraPalo Alto Networks Inc2603, 8999, 4001, 54041, 9595, 50805, 990, 5984, 5906, 6002... (191 more)
Activity shows a focused approach targeting CouchDB, and others. The attacker appears to be leveraging a data center hideout.
United States flag
157.245.242.170United StatesNew JerseyNorth BergenDigitalOcean LLC3306
Activity shows a focused attack targeting MySQL. The attacker appears to be leveraging a data center hideout.