What a server exposed on the Internet faces, live.
Port scans, SSH brute force, probing for sensitive files: these are the attacks actually received by a NextHop server, replayed continuously as they happen.
Attacks in real time
Each arc is a real attack received by the NextHop server, drawn from the city of the attacking machine.
Top attacking countries
Ranking for the last 24 hours. The origin shows where the attacking machines are hosted (often rented or compromised servers), not the nationality of the attackers.
| # | Country | Attacks | Share of total | ||||
|---|---|---|---|---|---|---|---|
Loading… | |||||||
The pace of attacks, hour by hour
Attacks never stop: bots and scanners work day and night.
Types of web attack
What malicious requests are looking for.
SSH usernames tried
Bots endlessly try default accounts.
Ports scanned
Looking for forgotten or poorly protected services (sample).
Key takeaways
This feed comes from a server with no particular profile: any exposed machine faces the same.
Found within minutes
A public IP address is scanned constantly. There is no such thing as a “small” server that goes unnoticed: it is found by bots, not by humans.
No passwords on SSH
Bots try root, admin, ubuntu… all day long. Key-based authentication only, root password login disabled.
No secrets in the website
.env files, .git directories and backups are favourite targets. They must never be reachable from the web.
Defence in depth
A restrictive firewall, blocking of addresses with a bad reputation, web request inspection and regular updates complement each other.