Real-time SSH brute force and intrusion detection intelligence from distributed honeypot servers monitoring attacks worldwide
White-label attack maps and firewall blacklist feeds for your security platform • Price on application
Our live attack map shows real-time SSH intrusion attempts across the globe — country by country, attack by attack. Embeddable into your platform and fully white-labelable with your own branding.
The attack map updates in real-time, plotting active SSH attack sources by country and attack volume. See exactly where attacks are originating, which IPs are most active, and how attack patterns shift throughout the day.
SigmaNetworks operates a distributed SSH honeypot network monitoring brute force and intrusion attempts in real-time from sources worldwide. Every attack attempt is immediately logged, analysed and scored — delivering actionable firewall intelligence through continuously updated blacklist feeds and embeddable live attack maps — ready to white-label and resell as part of your own security platform.
Embeddable real-time world map showing active SSH attack sources by country, attack volume and threat severity. Auto-refreshes every 60 seconds and fully white-labelable with your own branding and domain.
SSH honeypot servers capturing unauthorised login attempts and credential stuffing attacks from across the globe. Every attempt logged in real-time with full metadata.
Real-time identification of automated password guessing attacks. Attack frequency, timing patterns and source behaviour analysed to classify and score each attacker.
Tracking of common username and password combinations used by attackers. Targeted username lists and attack password patterns distributed as intelligence feeds.
Confirmed attacker IP lists updated in real-time, plus a consolidated daily master list. Compatible with iptables, ipset, fail2ban and most firewall platforms.
Country-level attack origin tracking with threat correlation. Highest origin country ranking, peak attack hour analysis and weekly trend reporting included.
Multi-dimension threat scoring per attacker IP — attack frequency, username targeting, historical patterns and attack vector classification. Critical, High and Medium severity levels.
Your logo, your domain, your brand. The live attack map and intelligence dashboard can be embedded directly into your customer portal or security product as a fully branded service.
Full detail of what the platform delivers
| Specification | Detail |
|---|---|
| Detection Method | Distributed SSH honeypot servers capturing real attack attempts |
| Attack Types Detected | Brute force, dictionary attacks, credential stuffing, port scanning |
| Blacklist Update Frequency | Real-time stream + consolidated daily at 02:00 UTC |
| IP Blacklist Formats | Raw IP list (ssh-ips.txt), consolidated combined list (ssh-combined.txt) |
| Credential Intelligence | Targeted username list, common attack passwords list |
| Threat Classification | Critical, High, Medium severity levels |
| Attack Categories | Brute Force, Dictionary Attack |
| Geographic Coverage | Global — IP geolocation across all monitored sources |
| Dashboard Refresh | 60-second auto-refresh, real-time streaming for new attacks |
| Attack Map | Live embeddable world map — sigmanetworks.co.uk/hack-map.php |
| AbuseIPDB Integration | Active contributor — confirmed attack IPs reported automatically |
| Firewall Compatibility | iptables, ipset, fail2ban, pfSense and most Linux firewall platforms |
| White-Label | Full custom branding, domain, logo and colour scheme |
| Embedding | iframe-embeddable attack map for customer portals and dashboards |
| API Access | Available — feed integration and IP status lookup |
Protect your customers' servers and offer a value-added firewall intelligence feed branded as your own service. Reduce support overhead from compromised instances.
Enrich your SIEM, IDS or firewall product with live SSH attack intelligence. Embed the attack map as a visual threat feed inside your security dashboard.
White-label the attack map and dashboard as a managed security deliverable — give clients a real-time window into global SSH attack activity.
Automate firewall blacklist updates via cron. Integrate IP status lookup into your SOC workflow without maintaining your own honeypot infrastructure.
One cron job pulls the latest confirmed attacker IPs directly into iptables or fail2ban. Credential pattern analysis helps identify which usernames to monitor closely.
Continuously updated corpus of real SSH attack data — source IPs, targeted usernames, password patterns, geographic origin and timing for research and analysis.
Pricing depends on your specific requirements — feed volume, white-label scope, API access level and embedding requirements. Contact us to discuss.
Price on application — tailored to your integration requirements, data volume and white-label scope.
White-label SSH attack maps and firewall feeds — branded as your own service
Get in Touch Today →Price on application • No obligation • Response within 24 hours