Security Operations
SSH Attack IP Extractor and Geolocation Report
Extracts IPs from failed SSH logins in auth.log, blacklists them, geolocates them and emails a per-country chart.
Project Overview
Internet-facing SSH servers see constant brute-force attempts. This tool turns auth.log into something actionable: a blacklist of attacking IPs and a picture of where the attempts come from.
Implementation Process
- Extracts IP addresses from "Invalid user" entries in
auth.logand saves them to a blacklist file. - Looks up geolocation for each IP and aggregates attempts by country.
- Generates a per-country bar chart and a world map with Matplotlib and GeoPandas.
- Emails the report with the chart attached.
Results
A ready-to-use blacklist plus a visual summary of attack sources.
Benefits
- Feeds firewall or fail2ban blocklists.
- Makes brute-force trends easy to explain to non-technical readers.
Contents
Related Projects
Interested in more security projects?
Explore my other security implementations and solutions.
View All Projects