Sentinel

SSH Attack Monitor

What is this?

I built this dashboard to visualize who's trying to break into my server. Every dot you see on the map is a real unauthorized login attempt happening against my server in Buffalo, NY.

It's kind of wild — within minutes of exposing SSH to the internet, bots from around the world start hammering away with common usernames like "root" and "admin". This project lets me watch it happen in real-time.

The dashboard displays attacks from the last hour — older data is automatically cleared.

This is one of my portfolio projects. Check out my other work:

Visit My Portfolio

How I Built It

1
Log Collection
My server runs systemd, which logs every failed SSH attempt. I tail these logs over an SSH tunnel.
2
IP Geolocation
A Python script extracts attacker IPs and geolocates them using the MaxMind GeoLite2 database.
3
Data Pipeline
Attack data flows into SQLite and gets served through a FastAPI endpoint that this frontend polls.
4
Live Visualization
This dashboard fetches new attacks every 1.5 seconds and animates them on the map with Leaflet.js.

Tech Stack

Python FastAPI SQLite Leaflet.js Chart.js Docker

Live Statistics

- Attacks (1 hour)

- Last 60 Seconds

- Unique IPs

- Countries

Connecting...

Live Attack Map

Each line shows an attack traveling from its origin to my server in Buffalo, NY.

My Server (Buffalo, NY)

Incoming Attack

Most Targeted Usernames

The usernames attackers try most often

Attacks by Country

Where the attacks are coming from

Recent Attacks

Live feed of incoming attack attempts

Waiting for attacks...