Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: SSH Scanning Activity SSH Scanning Activity

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Top 100 Usernames Attempted This Year
Username Attempts Percent
admin 205,785,173 34.79%
root 156,801,121 26.51%
system 19,039,935 3.22%
sh 18,397,065 3.11%
enable 15,747,684 2.66%
shell 12,519,497 2.12%
>/var/.ptmx && cd /var/ 10,422,084 1.76%
>/mnt/.ptmx && cd /mnt/ 8,514,600 1.44%
>/var/tmp/.ptmx && cd /var/tmp/ 8,430,456 1.43%
>/dev/netslink/.ptmx && cd /dev/netslink/ 8,425,655 1.42%
>/bin/.ptmx && cd /bin/ 8,424,956 1.42%
>/boot/.ptmx && cd /boot/ 8,423,617 1.42%
guest 7,580,184 1.28%
support 6,882,867 1.16%
enable 6,096,339 1.03%
user 5,694,096 0.96%
default 3,314,966 0.56%
shell 2,868,610 0.48%
adm 2,468,220 0.42%
/bin/busybox rm -rf 19ju3d 902i13 2,313,255 0.39%
Administrator 2,090,721 0.35%
supervisor 1,983,109 0.34%
111111 1,373,074 0.23%
sh 1,360,521 0.23%
linuxshell 1,349,486 0.23%
/bin/busybox rm -rf NiGGeR69xd dropper 1,311,914 0.22%
22 1,307,950 0.22%
>/tmp/.misa && cd /tmp/ 1,306,008 0.22%
1234 1,277,032 0.22%
service 1,254,377 0.21%
ubnt 1,222,089 0.21%
enable\x00 1,162,718 0.20%
>/dev/.misa && cd /dev/ 1,111,535 0.19%
shell\x00 1,103,856 0.19%
>/var/run/.misa && cd /var/run/ 1,101,232 0.19%
>/.misa && cd / 1,098,884 0.19%
>/dev/shm/.misa && cd /dev/shm/ 1,098,865 0.19%
>/etc/.misa && cd /etc/ 1,098,856 0.19%
>/usr/.misa && cd /usr/ 1,098,832 0.19%
pi 1,031,712 0.17%
tech 958,402 0.16%
mother 947,663 0.16%
admin1 935,436 0.16%
888888 933,533 0.16%
666666 930,088 0.16%
/bin/busybox rm -rf nya oxdedfgt 927,602 0.16%
wlahh 821,545 0.14%
>/tmp/.ptmx && cd /tmp/ 772,142 0.13%
oracle 766,671 0.13%
>/dev/.ptmx && cd /dev/ 677,850 0.11%
>/etc/.ptmx && cd /etc/ 666,753 0.11%
>/usr/.ptmx && cd /usr/ 666,696 0.11%
>/var/run/.ptmx && cd /var/run/ 666,566 0.11%
>/.ptmx && cd / 666,364 0.11%
>/dev/shm/.ptmx && cd /dev/shm/ 666,318 0.11%
system 587,764 0.10%
/bin/busybox rm -rf lzrd oxdedfgt 537,774 0.09%
tomcat 493,785 0.08%
test 455,717 0.08%
linuxshell 435,672 0.07%
bah 380,568 0.06%
ftp 379,256 0.06%
telecomadmin 375,353 0.06%
/bin/busybox rm -rf zhr zehir 321,031 0.05%
ftpuser 320,505 0.05%
nagios 308,720 0.05%
telnetadmin 308,446 0.05%
telnet 284,373 0.05%
123 275,214 0.05%
operator 268,658 0.05%
0 266,941 0.05%
1111 251,648 0.04%
101 251,546 0.04%
sh\x00 251,487 0.04%
a 248,479 0.04%
123321 248,016 0.04%
/bin/busybox rm -rf mezy myth 243,800 0.04%
12345 240,227 0.04%
266344 238,806 0.04%
adam 238,036 0.04%
1502 236,100 0.04%
aaa 235,004 0.04%
3comcso 234,836 0.04%
adfexc 233,332 0.04%
acc 232,190 0.04%
nproc 229,649 0.04%
/bin/busybox rm -rf f7s41 t0n41 222,547 0.04%
daemon 217,052 0.04%
mg3500 210,614 0.04%
mcUser 207,895 0.04%
e8telnet 200,307 0.03%
ubuntu 190,958 0.03%
>/var/.pptmx && cd /var/ 189,950 0.03%
wlahh\x04 185,473 0.03%
usuario 181,519 0.03%
postgres 179,649 0.03%
e8ehome 173,280 0.03%
/bin/busybox rm -rf SO190Ij1X dropper 172,962 0.03%
manager 168,814 0.03%
mysql 160,140 0.03%