IT
10.797.565records yesterday
165.001distinct addresses
963sensors reporting
—last read

SANS Internet Storm Center · firewall logs from volunteer sensors · no geolocation

Yesterday 165.001 different addresses tried to get in somewhere.

This is not an attack map and it does not say who is attacking whom. It says something more modest and verifiable: which ports are being knocked on right now, how many distinct machines are trying, and how long the most persistent ones have been around.

No data. The source has not answered yet, and this page shows zero rather than filler.

Where the numbers come from All of it from isc.sans.edu, the SANS Internet Storm Center: firewall logs sent voluntarily by around a thousand sensors worldwide, aggregated and published through an open API with no key. None of the data is mine, none of it is estimated, and if the source does not answer this page shows zero rather than filler.

What this page does not say It does not say which country an attack comes from, nor who receives it: the source provides no geography, and deriving it from IP addresses would imply a precision that is not there. Maps drawing arcs between continents are almost always showing hits against their own publisher's sensors, presented as a live world war.