One of many tests with Afterglow, visualizing SSHD brute force logins (yellow) vs source IP addresses (green).
This one shows quickly the IPs that have the most activity (one IP has the most: the yellow explosion in the middle), along with popularly attempted userids, and the IPs which have been attempting the same userids.