Home/Threat intelligence/Brute-force sources

Brute-force sources

Aggregate failed logins, password brute force and login probing against SSH and other authentication surfaces.

Observation window
No public activity observed in this window

This only means the current sensors recorded nothing in the selected window; it does not mean this activity is absent from the Internet.

Total events0Within selected window
Public sources0Unique source IPs
24-hour events0Current activity
Observing sensors0Observation coverage
Last observedNot recordedUTC evidence time

Daily events and sources

Shows up to the latest 30 days in the selected window. Bar height is event volume; the number is unique sources that day.

There are no public events to plot in this window.

Public source aggregates

Only redacted source IP, type, protocol, destination port, count and time are shown. Open an IP for its complete threat evidence.

0 sources
No public source records in this windowPrivate, loopback, link-local and documentation ranges never enter the public ranking.

Types, protocols and destination ports

Event types

Not recorded

Protocols

Not recorded

Destination ports

Not recorded

CHA.LA owned-observation modelScanning, brute force and web attacks are classified independently from sensor event type and protocol. One event may belong to both scanning and web probing. Not observed never means safe.The public page never exposes usernames, passwords, request paths, User-Agent values, payloads or sensor identifiers.ClickHouse analytics · Aggregated 10/15/2026, 07:04:28