Honeypot Network Harvests 1.5 Million SSH Login Attempts in 30 Days
Harvesting SSH Credentials: Insights from My Honeypot Network
A security researcher shares data from a 30-day honeypot network of 15 servers worldwide, revealing 6,790 unique attacker IPs and 1.5 million login attempts. The top credentials are predictable (root/123456), and attackers are concentrated in Asia and Europe. The post details the technical setup (Ansible, Podman, Python/Paramiko) and plans for expansion.
Most honeypots are currently in Europe (60%) - I plan to add more.
- dspillett
That doesn't look to me like it would find many real credentials. It is collecting the credentials that automated bots are trying to use, some of them, perhaps many of them, will be credentials that someone somewhere is using for something, but unless you are planning an Internet wide scan yourself using those credentials to try login to something is likely to be fruitless.
- pastage
Last time I saw this an obscure single letter root password was still "secure", now days seems like almost all non-alphanumeric chars works. % is my new root password it still has not been brute forced.
- ufmace
I'd be more curious to know what these SSH scanner bots actually do if they manage to log in. Automated recon, install spambot/cryptominer/phishing site, something else?
- enjaydee
Is OP here? Curious as to what they used for geolocation
- daneel_w
No "credentials" are being "harvested" here. It's all worthless data, save for the statistics.