Skip to content
Install MCP

Threat feed

SSH Password Auth

Last fetched

Brute Force · refreshed hourly · last verified

SSH Password Auth is a Brute Force threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 3 indicators listed by it.

What is SSH Password Auth

SSH Password Auth is the DataPlane.org companion feed to SSH Client Attacks, narrowed to IPs observed completing the SSH handshake and attempting password-based authentication against honeypot SSH services. Password-auth is a stronger signal than connection-only because it requires the attacker's tooling to actually present credentials — so the feed has a higher attack-confidence than scanner-only lists. Operators deploy it as a pre-authentication deny-list and as a SIEM enrichment overlay for production SSH log analysis. It is indexed here because the DataPlane.org methodology is well-documented and reproducible, making it useful as an academic-research baseline.

Source
https://dataplane.org/
Refresh cadence
hourly

Category drift. The curated category for this feed is Brute Force, while WhisperGraph currently files it under bruteforce.

Indicators currently listed

3 indicators across 1 node type.

IPV4 · 3

Related pages

Pivot from SSH Password Auth into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.