Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Request for logs please.

So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH username lists by country?"

I happen to think that this would be an interesting little project and would like to do some research but to make this a statistically useful exercise will require access to more logs than I have.

So, would any of you be willing to share SSH logs for failed passwords /invalid users?

The logs would need to contain the source IP and enough verbose detail for me to see either a failed password attempt or an invalid user name used.

share|improve this question
Good luck with getting people to hand over these logs... ;) – Steve Dec 17 '10 at 16:29
Given enough time to sanitize them, maybe. There are existing lists like this out there in various forms of public accessibility. – Scott Pack Dec 17 '10 at 16:59
Not asking for anything sensitive - as an example this is one of the logs being sent to me for this project: Dec 17 12:56:11 cronos sshd[25122]: Failed password for root from port 46635 ssh2 – David Stubley Dec 17 '10 at 17:48

Like Project Honeypot?

These are spam harvesters, but the idea is the same. By country

share|improve this answer
useful links - cheers. – Rory Alsop Jan 10 '11 at 16:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.