Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: ISC Feature of the Week: SSH Scan Reports - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
ISC Feature of the Week: SSH Scan Reports

Our feature this week introduces Dr. Ullrich's newest system addition addressing wide spread reports of SSH scans. This system collects logs you submit via a special API URL. We keep receiving reports from readers about wide spread ssh scans. This system was setup to get a better handle on these scans. Reporting will be released as soon as there is enough information collected.


  • Reports are "POST"ed to
  • Parameters are userid, authkey, data(tab-delimited log data)
  • XML status OK returned on successful submission
    • This only accepts data. Validation and processing are done at a later time

There is currently a PERL script to collect data from the "kippo" honeypot available at

Post suggestions or comments in the section below or send us any questions or comments in the contact form on
Adam Swanger, Web Developer (GWEB, GWAPT)
Internet Storm Center


86 Posts
Nov 29th 2012
I see a lot of attempts against my SSH server. Very thankful for fail2ban
I have it configured for 1 try and 10 minute ban.

7 Posts
fail2ban already has a dshield "action" that can be used to report scans. Please enable it (see the dshield.conf file that comes with fail2ban for details). With fail2ban, you don't get passwords, but you still get the source IP that is reported to Dshield as a "port 22 portscan").

4476 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!