Global SSH Client Activity Sudden Collapse

Around October 6, 2021, observers across multiple unrelated networks noticed a dramatic and unexplained collapse in SSH client connection attempts globally. The drop was particularly pronounced among traffic attributable to the libssh library. The anomaly was independently observed by SANS Internet Storm Center port-22 monitors and NETSCOUT ASERT analysts, confirming it was a real global phenomenon rather than a local measurement artifact.

Despite the unusual nature and scale of the event, no public explanation was ever provided for the sudden and sustained drop in SSH scanning/probing activity. The event remains an unexplained data point in internet measurement history.