Every host exposing SSH to the internet.
Each IPv4 and IPv6 address seen with TCP port 22 open, carrying the SSH server banner and the host-key fingerprint where the host completed a handshake, and a flag that separates a confirmed SSH service from a port that answered but stayed silent. Built from internet-wide measurement over a 90-day window.
Schema at a glance.
See documentation →The database's schema and metadata are documented carefully. It is published as CSVGZ.
Sample rows for this build are not published yet. Ask us for a slice and we will send one from the current build.
Downloading it from code.
Database API reference →One call gets you the current SSH IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("ssh_ip_v1")client.database.download("ssh_ip_v1", "csvgz", "./ssh_ip_v1.csv.gz")sums = client.database.checksums("ssh_ip_v1", "csvgz")print(meta.updated, meta.entries, sums["sha256"])
Getting your hands on it.
The file is the product. Teams join SSH IP against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Attack-surface audit
Find your own hosts answering on TCP 22, and the ones that should never be exposed to the internet.
Infrastructure tracking
Match host-key fingerprints across addresses to follow the same infrastructure as it moves between IPs.
Risk scoring
Weight traffic from hosts running old or unusual SSH implementations, read straight from the banner.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints — list what you are licensed for, poll a build, follow the download redirect, verify what landed. Install commands are in the docs.
No loose ends.
How often does this database rebuild?
Each Probe database publishes its own cadence and its last build date — the port-scan databases weekly, BGP Route daily. The scan databases carry a rolling 90-day observation window, so first seen and last seen are relative to it. Ask the metadata endpoint before you fetch.
What does an open port actually tell me?
That the host answered on that port during the window. Where the protocol exchange completed, the row also carries the service banner, and session_ok is true; where the port was open but silent, session_ok is false. The open set and the confirmed service ship in one file so you can tell them apart.
What is in a row?
For the port-scan databases, one host: its address, the port, and what it returned. For BGP Route, one announced prefix and origin, with its RPKI standing. IPv4 and IPv6 are in the same file.
Which formats does a build ship in?
Gzipped CSV. These databases are keyed per host, or per prefix for BGP Route, rather than per range, so there is no MMDB form.
Does a flag here mean we should block?
No. It means the address exposes that service, or announces that route. Blocking is a policy decision — the columns exist so it can be yours rather than ours.
Test the real build first.
An evaluation license puts a full current build in your hands — every row, every column, no sampling — so you can measure it against your own traffic before anyone talks about terms.