Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: SSH Scanning Activity SSH Scanning Activity

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Top 100 Usernames Attempted This Year
Username Attempts Percent
root 109,216,866 34.29%
admin 108,292,389 34.00%
sh 10,634,798 3.34%
enable 9,473,723 2.97%
support 8,110,701 2.55%
user 7,985,766 2.51%
guest 6,792,276 2.13%
linuxshell 4,467,663 1.40%
iptables -F 4,298,762 1.35%
default 2,868,275 0.90%
Administrator 2,231,443 0.70%
supervisor 2,049,828 0.64%
enable 1,833,036 0.58%
ubnt 1,755,713 0.55%
test 1,204,443 0.38%
shell 1,179,953 0.37%
ping ; sh 1,152,528 0.36%
nproc 1,139,836 0.36%
service 1,096,552 0.34%
admin1 1,060,899 0.33%
666666 1,057,544 0.33%
888888 1,055,824 0.33%
tech 1,036,250 0.33%
mother 1,014,790 0.32%
pi 841,682 0.26%
system 737,803 0.23%
0 562,524 0.18%
oracle 537,349 0.17%
tomcat 385,310 0.12%
ubuntu 375,216 0.12%
postgres 301,811 0.09%
system 250,026 0.08%
>/var/.ptmx && cd /var/ 233,681 0.07%
sh 227,921 0.07%
linuxshell 173,467 0.05%
git 172,956 0.05%
ftpuser 171,707 0.05%
telnetadmin 146,852 0.05%
>/mnt/.ptmx && cd /mnt/ 145,844 0.05%
>/dev/netslink/.ptmx && cd /dev/netslink/ 145,127 0.05%
>/var/tmp/.ptmx && cd /var/tmp/ 145,112 0.05%
>/bin/.ptmx && cd /bin/ 145,110 0.05%
>/boot/.ptmx && cd /boot/ 145,108 0.05%
shell 139,998 0.04%
22 131,612 0.04%
CUAdmin 127,810 0.04%
deploy 118,224 0.04%
telecomadmin 116,483 0.04%
osmc 115,942 0.04%
mysql 104,999 0.03%
www 96,853 0.03%
bin 94,976 0.03%
GET / HTTP/1.1 90,906 0.03%
hadoop 90,424 0.03%
nagios 83,475 0.03%
ftp 71,906 0.02%
jenkins 71,161 0.02%
hikvision 67,984 0.02%
dnsekakf2$$ 66,461 0.02%
ftpadmin 63,922 0.02%
user1 63,342 0.02%
demo 60,636 0.02%
telnet 58,966 0.02%
student 58,730 0.02%
testuser 58,624 0.02%
vstarcam2015 57,348 0.02%
enable\x00 56,652 0.02%
teamspeak 55,250 0.02%
server 54,641 0.02%
test1 54,113 0.02%
minecraft 53,904 0.02%
1234 53,638 0.02%
ts3 53,529 0.02%
odoo 53,050 0.02%
debian 52,761 0.02%
dev 51,928 0.02%
daemon 50,584 0.02%
wlahh 46,960 0.01%
teladmin 46,459 0.01%
shell\x00 45,440 0.01%
e8ehome 45,145 0.01%
bah 44,319 0.01%
centos 43,501 0.01%
ispadmin 40,970 0.01%
isp 40,800 0.01%
web 40,292 0.01%
apache 40,242 0.01%
alex 39,210 0.01%
defa 39,046 0.01%
backup 38,909 0.01%
e8telnet 38,745 0.01%
none 37,310 0.01%
zabbix 36,940 0.01%
sshd 36,866 0.01%
1111111 36,639 0.01%
>/tmp/.ptmx && cd /tmp/ 36,333 0.01%
localhost 36,126 0.01%
ansible 35,334 0.01%
localadmin 34,980 0.01%
tester 34,673 0.01%