Every host exposing SSH to the internet.
Each IPv4 and IPv6 address that completed an SSH handshake on TCP port 22, with the server banner it announced and its host-key fingerprint. A port that was open but never answered isn't in the file. Built from internet-wide measurement over a 90-day window.
Schema at a glance.
See documentation →The database's schema and metadata are documented carefully. It is published as CSVGZ.
| ip | port | banner | host_key_fp | session_ok | first_seen | last_seen |
|---|---|---|---|---|---|---|
| 5.180.47.192 | 22 | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19 | SHA256:576b2d0a2863d4c6a4abc0e05eaa1ab2993c06e98089bbaaff645baabc3f11c3 | 1 | 2026-07-15 | 2026-09-19 |
| 1.192.215.231 | 22 | SSH-2.0-dropbear_2024.84 | SHA256:2050736ff64bf1ff7911d6d62a147491acae1436f0d88f3c9b064c72f3a46f78 | 1 | 2026-07-26 | 2026-09-12 |
| 1.0.16.9 | 22 | SSH-1.99-Cisco-1.25 | SHA256:734b42a33ad07d6a2f0fc73798d5cd77f0f24d812e1c754cf35f9d485e1c2aef | 1 | 2026-07-07 | 2026-09-21 |
| 79.232.228.42 | 22 | SSH-2.0-lancom | SHA256:12ebf040135161ec00a7e35a71d6f54486f792b551c5a1d92ec2c8b0d7fb5b41 | 1 | 2026-09-12 | 2026-09-12 |
| 85.220.229.35 | 22 | SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4 | SHA256:9cb49151a5ad45f7ccf9db76669baa397e747cda583f08a9dd6d62229a633816 | 1 | 2026-07-05 | 2026-10-01 |
Downloading it from code.
Database API reference →One call gets you the current SSH IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("ssh_ip_v1")client.database.download("ssh_ip_v1", "csvgz", "./ssh_ip_v1.csv.gz")sums = client.database.checksums("ssh_ip_v1", "csvgz")print(meta.updated, meta.entries, sums["sha256"])
Where it occurs.
SSH IP holds 23,300,647 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.
By country
Of the 23,300,647 IP Geolocation places.
- United States6,271,398 · 26.92%
- China3,304,210 · 14.18%
- Germany1,739,009 · 7.46%
- France1,029,173 · 4.42%
- Russia1,010,741 · 4.34%
- The Netherlands960,344 · 4.12%
- Singapore882,477 · 3.79%
- Hong Kong742,895 · 3.19%
- Japan666,757 · 2.86%
- United Kingdom630,840 · 2.71%
By network
Each /24 counted for the AS announcing most of it.
- AS14061DigitalOcean, LLC1,610,910 · 6.91%
- AS37963Hangzhou Alibaba Advertising Co.,Ltd.1,359,973 · 5.84%
- AS31898Oracle Corporation985,830 · 4.23%
- AS396982Google LLC832,139 · 3.57%
- AS16276OVH SAS785,473 · 3.37%
- AS45090Shenzhen Tencent Computer Systems Company Limited781,201 · 3.35%
- AS45102Alibaba (US) Technology Co., Ltd.647,507 · 2.78%
- AS20473The Constant Company, LLC418,757 · 1.80%
- AS132203Tencent Building, Kejizhongyi Avenue409,185 · 1.76%
- AS8075Microsoft369,862 · 1.59%
Getting your hands on it.
The file is the product. Teams join SSH IP against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Attack-surface audit
Find your own hosts answering on TCP 22, and the ones that should never be exposed to the internet.
Infrastructure tracking
Match host-key fingerprints across addresses to follow the same infrastructure as it moves between IPs.
Risk scoring
Weight traffic from hosts running old or unusual SSH implementations, read straight from the banner.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints — list what you are licensed for, poll a build, follow the download redirect, verify what landed. Install commands are in the docs.
No loose ends.
Does every row have a banner?
Yes. A row is a host that completed an SSH handshake, so it carries a banner and a host key, and session_ok is 1. A port that was open but never answered isn't in the file.
What does the banner tell us?
The SSH software, and often the operating system and its patch level, as the server announces itself: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19, say.
What can we do with host_key_fp?
Match it across addresses. The same key on several addresses links them, which follows infrastructure as it moves between IPs; cloned images and appliances that ship one key are the exception to read around.
How long does an address stay in the file?
As long as it answered a handshake in the last 90 days: first_seen and last_seen are the first and last days in that window the port was seen open.
How often is it rebuilt?
Weekly over a rolling 90-day window, which first_seen and last_seen are relative to. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV. Each row is one address, so a prefix tree would not make it smaller. Poll the metadata call first and fetch only when the build has changed.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands — every row, every column, no sampling — so you can measure it against your own traffic before anyone talks about terms.