Formerly sshbl.org, these guys are now changing to openbl.org as they increase the monitoring and blacklisting from ssh scans to also include ftp and other daemons. While they have a statistics page for the ssh attackers I have put together some visualizations of the source addresses. Similar to what I did for the Tor Exit Nodes.
For those interested in protecting themselves from ssh brute force scanning, I recommend three steps that are not only easy but very effective.
Step 1: Move your ssh daemon to another port such as 2222.
Step 2: Ensure your passwords are complex and not dictionary based.
Step 3: Install OSSEC or another log monitoring HIDS and get some alerts if anyone does hit 2222. This will not happen very often.
Clicking on the images below will load an interactive map that is updated daily.
SSH Source Attackers By Country
SSH Source Attackers By City on World Map
SSH Source Attackers By City on USA Map
SSH Source Attackers By City on European Map





