Skip to content
Install MCP

Threat feed

SSH Client Attacks

Last fetched

Brute Force · refreshed hourly · last verified

SSH Client Attacks is a Brute Force threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 3 indicators listed by it.

What is SSH Client Attacks

SSH Client Attacks is a feed of IP addresses observed by the DataPlane.org passive-sensor network as making client-initiated SSH connections to honeypots configured to look like attractive targets. Because the sensors do not advertise SSH services to legitimate clients, a connection from any IP is by definition either a scan or a brute-force attempt. The feed is most useful as a pre-authentication deny-list for production SSH gateways: blocking IPs that DataPlane has already seen scanning shaves off the loudest portion of attack traffic without complex log analysis. It is indexed here as a passive-sensor-grounded SSH-abuse reference.

Source
https://dataplane.org/
Refresh cadence
hourly

Category drift. The curated category for this feed is Brute Force, while WhisperGraph currently files it under bruteforce.

Indicators currently listed

3 indicators across 1 node type.

IPV4 · 3

Related pages

Pivot from SSH Client Attacks into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.