Projects & Tools
DenyHosts Statistical Summary
| Clients contributing data | 191,924 |
|---|---|
| Hosts denied by DenyHosts | 12,229,136 |
| Unique hosts denied | 1,063,586 |
| Average hosts denied per client | 63.72 |
| Most attacked client | 9,467 |
| Denied hosts today (through 11:49 AM PDT) | 6,305 |
| Denied hosts yesterday | 12,850 |
| Denied hosts daily average (1 week) | 11,923.43 |
Statistics as of July 17, 2011. Recent thwarted attempts originated from Brazil, China, United States, and Portugal.
About Phil Schwartz
Phil Schwartz is a Senior Software Developer with experience in C, C++, Java, and Python. He is the lead software developer of several open source projects including Kodos, ReleaseForge, Scratchy, DenyHosts, and FAQtor.
For open source project inquiries, contact phil_schwartz @ SourceForge. Additional projects and interests are listed on the Other page.
Learn how to efficiently manage and query large volumes of log data in my latest article on Python Log Aggregation with Streaming Database Storage Python Log Aggregation with Streaming Database Storage. The DenyHosts statistical summary provides a real-time window into the global landscape of SSH attack activity. By aggregating data from thousands of contributing clients around the world, the system tracks denied hosts, attempted logins, and the geographic origins of malicious traffic. Countries such as China, the United States, Brazil, Russia, and various European nations frequently appear among the top sources of attacks. This kind of intelligence helps system administrators understand threat patterns and adjust their security postures accordingly. The daily, hourly, and weekly breakdowns allow for granular analysis of when attacks spike and which IP ranges are most persistent. For anyone running a public-facing SSH server, this data is invaluable for recognizing emerging threats and reinforcing defenses against brute-force login attempts.
One of the core tools showcased on this site is DenyHosts itself, a Python-based security utility designed to thwart SSH brute-force attacks. Operating under the GNU Public License, DenyHosts works by monitoring authentication logs for failed login attempts and dynamically updating hosts.deny files to block offending IP addresses. The software supports both manual and automated whitelisting, ensuring that legitimate users are not inadvertently locked out. Its distributed data-sharing feature allows participating clients to benefit from a collective blocklist, making the entire community more resilient. Over the years, DenyHosts has become a staple in Linux server security, valued for its simplicity, effectiveness, and open-source ethos. Check out my latest write-up on building a Python tool to compare DNS caches for poisoning risks, a practical deep dive into a real-world security concern. Building a Python DNS cache comparison tool for poisoning risks The project continues to evolve, maintaining compatibility with modern distributions and authentication methods.
Kodos is a regular expression debugger for Python, also hosted under the GNU Public License. This graphical tool provides a visual environment for constructing, testing, and refining regex patterns in real time. Developers can input sample text, apply regular expressions, and immediately see which portions match, making it far easier to troubleshoot complex patterns. Kodos supports Python's full regex syntax and includes features such as syntax highlighting, match grouping, and a library of common expressions. A Windows installer is available, broadening its accessibility beyond Linux users. For anyone working with text processing, log parsing, or data validation in Python, Kodos reduces the trial-and-error overhead of regex development and helps produce accurate, efficient patterns more quickly. You can learn how the underlying structure that tracks attacking IP addresses was architected in my in-depth walkthrough: Designing DenyHosts’ data model for attack sources.
Scratchy is an Apache log parser tool that falls under the GNU Public License, designed to help web administrators make sense of their server logs. By parsing raw Apache access and error logs, Scratchy generates structured reports that highlight traffic patterns, error frequencies, and potential security concerns. A sample report is available for users to preview the tool's output before committing to its use. The parser can handle large log files efficiently, filtering out noise and focusing on actionable data. For site owners who need to understand visitor behavior, diagnose server issues, or identify suspicious activity, Scratchy offers a straightforward, command-line-driven solution. Its open-source nature means it can be customized to fit specific reporting needs or integrated into broader monitoring workflows.
Canyonero is a custom project management application developed for teams that need a tailored approach to tracking work. Unlike generic project management suites, Canyonero is built with flexibility in mind, allowing organizations to define workflows, task types, and reporting structures that match their actual processes. The application is described as a custom application, suggesting it may be adapted for specific industries or internal use cases. Its presence on this site indicates a practical, hands-on philosophy toward software development—building tools that solve real problems rather than forcing teams to adapt to rigid commercial platforms. For groups managing complex projects with unique requirements, Canyonero represents an alternative to off-the-shelf solutions, prioritizing adaptability and direct control over feature breadth.
The statistical summary page reveals the sheer scale of SSH attack activity on the internet. With hundreds of thousands of clients contributing data and millions of hosts denied, the numbers underscore how pervasive brute-force attempts have become. The geographic breakdown shows that attacks originate from virtually every country, though certain regions consistently dominate the lists. Temporal patterns also emerge, with attack volumes fluctuating by hour, day, and month. This data not only helps individual administrators block malicious IPs but also contributes to a broader understanding of cyber threat trends. The open, collaborative nature of DenyHosts means that every participant strengthens the network effect, making the entire community harder to penetrate over time.
Resiliency is a recurring theme in the DenyHosts ecosystem. The system is designed to withstand high volumes of attack data while maintaining accurate and timely blocklists. Even when individual servers face aggressive brute-force campaigns, the distributed nature of the data-sharing network ensures that new threats are quickly identified and propagated. The statistical summary tracks metrics such as earliest and most recent attacks, average daily denied hosts, and the number of unique attacking addresses. This historical perspective allows administrators to assess whether their servers are experiencing typical background noise or a targeted assault. Over months and years, the data builds a comprehensive picture of the threat landscape, helping security professionals make informed decisions about firewall rules, rate limiting, and authentication policies.
The visual design of the DenyHosts statistical summary page reflects a utilitarian, data-dense approach. A bright magenta header bar anchors the page, while yellow and black advertising blocks provide strong visual contrast. The layout prioritizes information density, with compact spacing, sans-serif typography, and thin horizontal rules separating sections. This aesthetic is reminiscent of news aggregators and technical dashboards where content volume is high and every pixel must serve a purpose. Color is used sparingly but effectively: blue for section labels, red-orange for date markers, and black text on white backgrounds for readability. The overall effect is functional rather than decorative, emphasizing the data itself over visual embellishment. This design philosophy aligns well with the technical, no-nonsense audience that the site serves.
Beyond the headline statistics, the DenyHosts summary page offers deep dives into hourly and daily activity patterns. Administrators can see which hours of the day attract the most attack attempts, which days of the week see heightened activity, and how these patterns shift over months. The data also breaks down attacks by country of origin, revealing how geopolitical events or changes in internet infrastructure can influence attack traffic. For example, certain regions may appear more prominently during specific months, reflecting seasonal variations in cybercriminal activity or shifts in botnet command structures. This temporal and geographic granularity transforms raw numbers into actionable intelligence, enabling proactive defense measures such as adjusting fail2ban configurations, tightening SSH key policies, or implementing geo-blocking rules.
The suite of tools presented on this site—DenyHosts, Kodos, Scratchy, and Canyonero—reflects a broader commitment to practical, open-source software development. Each project addresses a specific need: SSH security, regex debugging, log analysis, and project management. Together, they demonstrate how small, focused utilities can have outsized impact when released under permissive licenses and supported by active communities. The site itself serves as both a distribution point and a showcase, with the statistical summary acting as a living demonstration of DenyHosts in action. For developers and system administrators seeking reliable, no-frills tools that solve real problems without vendor lock-in, this collection represents a valuable resource. The open-source ethos ensures that each tool can be inspected, modified, and improved by its users.