Harvesting SSH Credentials: Insights from my Honeypot Network
I’ve been working on this honeypot network for the past couple of months, and I’d now like to share some information from the first 30 days.
In this article::
- Intro and short summary
- the Data - credentials, attack sources, and so on
- the Tech - servers, automation, honeypot
- the Future - some plans and next steps
The project is still work-in-progress and I plan to improve it over time. The presentation is still a little bit rough, but this will do for now.
Feedback and questions are welcome!
Intro #
Locations of honeypots
References for this article:
- Timeframe = July 2026
- 15 servers (only dedicated for this purpose)
- 15 IPs, IPv4
- all over the world (see above)
- 5 VPS Providers
- SSH Honeypot, Port 22/TCP
The Data #
Some things to consider before we start:
- Most honeypots are currently in Europe (60%) - I plan to add more
- Passwords and usernames are percent-encoded (like an URL) to provide the information lossless and fully reversible - use Cyberchef to reverse it.
- Only login attempts are considered - scans or other attacks are not (yet)!
- I can’t publish the IPs of the attackers as I am not yet familiar with the privacy laws
Presentation is still rough, but will improve with next versions.
Summary
Unique IPs: 6790
Total Login Attempts: 1,531,053
Unique Credentials: 131922 (Pair UN+PW)
Unique Usernames: 12238
Unique Passwords: 97621
Attack IP Sources #
Continent
== Continent by unique IPs ==
IPs share continents
4084 60.1% Asia
1294 19.1% Europe
832 12.3% North America
360 5.3% South America
190 2.8% Africa
30 0.4% Oceania
---------- ------ ---
6790 100.0% 6 distinct continents
== Continent by login attempts ==
attempts share continents
921439 60.2% Europe
453254 29.6% Asia
97441 6.4% North America
38604 2.5% South America
18793 1.2% Africa
1522 0.1% Oceania
---------- ------ ---
1531053 100.0% 6 distinct continents
== Continent by attempts per IP ==
att/IP IPs attempts continents
712.1 1294 921439 Europe
117.1 832 97441 North America
111.0 4084 453254 Asia
107.2 360 38604 South America
98.9 190 18793 Africa
50.7 30 1522 Oceania
---------- -------- ----------- ---
225.5 6790 1531053 6 distinct continents, average
Country
== Country by unique IPs ==
IPs share countries
1653 24.3% China
721 10.6% United States
458 6.7% India
338 5.0% Vietnam
286 4.2% South Korea
276 4.1% Netherlands
236 3.5% Hong Kong
206 3.0% Germany
184 2.7% Brazil
182 2.7% Russia
178 2.6% Singapore
169 2.5% Indonesia
162 2.4% France
134 2.0% Malaysia
123 1.8% Taiwan
78 1.1% Japan
78 1.1% United Kingdom
71 1.0% Sweden
55 0.8% Iran
53 0.8% Bangladesh
1149 16.9% ... 109 more
---------- ------ ---
6790 100.0% 129 distinct countries
== Country by login attempts ==
attempts share countries
686449 44.8% Netherlands
112793 7.4% China
72314 4.7% United States
70413 4.6% Indonesia
68810 4.5% Romania
46318 3.0% Vietnam
44404 2.9% Singapore
38194 2.5% India
32136 2.1% South Korea
31171 2.0% Germany
30740 2.0% Hong Kong
28103 1.8% France
19012 1.2% Mexico
17765 1.2% Brazil
15047 1.0% Japan
14221 0.9% Poland
13478 0.9% Finland
12366 0.8% Russia
12272 0.8% Switzerland
12001 0.8% Turkey
153046 10.0% ... 109 more
---------- ------ ---
1531053 100.0% 129 distinct countries
== Country by attempts per IP ==
(74 countries with fewer than 10 IPs excluded)
att/IP IPs attempts countries
2646.5 26 68810 Romania
2487.1 276 686449 Netherlands
721.9 17 12272 Switzerland
644.2 13 8374 Lithuania
446.5 16 7144 Peru
421.3 19 8005 Uzbekistan
421.2 32 13478 Finland
416.6 169 70413 Indonesia
414.4 25 10361 Spain
374.2 38 14221 Poland
372.8 51 19012 Mexico
315.7 11 3473 Nigeria
300.0 40 12001 Turkey
249.5 178 44404 Singapore
192.9 78 15047 Japan
185.3 53 9820 Bangladesh
173.5 162 28103 France
151.3 206 31171 Germany
150.6 78 11746 United Kingdom
139.7 55 7686 Iran
84.5 4995 422119 ... 35 more
---------- -------- ----------- ---
230.1 6538 1504109 55 distinct countries, average
(74 countries with fewer than 10 IPs excluded)
ASN
== ASN by unique IPs ==
IPs share ASNs
303 4.5% AS8075 Microsoft Corporation
280 4.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street
259 3.8% AS14061 DigitalOcean, LLC
212 3.1% AS4811 Shanghai Telecom Company
193 2.8% AS4766 Korea Telecom
182 2.7% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.
163 2.4% AS137718 Beijing Volcano Engine Technology Co., Ltd.
139 2.0% AS4837 CHINA UNICOM China169 Backbone
115 1.7% AS4818 DiGi Telecommunications Sdn Bhd., Digi Internet Exchange
110 1.6% AS197170 TechTies Inc.
107 1.6% AS16276 OVH SAS
105 1.5% AS7552 Viettel Group
99 1.5% AS9808 China Mobile
92 1.4% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED
84 1.2% AS132203 Shenzhen Tencent Computer Systems Company Limited
83 1.2% AS45102 Alibaba US Technology Co., Ltd.
73 1.1% AS24086 Viettel Corporation
69 1.0% AS37963 Hangzhou Alibaba Advertising Co.,Ltd.
61 0.9% AS31898 Oracle Corporation
57 0.8% AS17421 Chunghwa Telecom Co., Ltd.
4004 59.0% ... 1314 more
---------- ------ ---
6790 100.0% 1334 distinct ASNs
== ASN by login attempts ==
attempts share ASNs
448559 29.3% AS197170 TechTies Inc.
155510 10.2% AS48090 TECHOFF SRV LIMITED
74735 4.9% AS198364 BANATSYNC SRL
74165 4.8% AS47890 UNMANAGED LTD
35226 2.3% AS7713 Telekomunikasi Indonesia PT
29003 1.9% AS14061 DigitalOcean, LLC
25947 1.7% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED
24795 1.6% AS63930 Ready Server Pte Ltd
22878 1.5% AS4766 Korea Telecom
20814 1.4% AS4837 CHINA UNICOM China169 Backbone
19120 1.2% AS8075 Microsoft Corporation
18970 1.2% AS45102 Alibaba US Technology Co., Ltd.
18503 1.2% AS16276 OVH SAS
16744 1.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street
13674 0.9% AS38731 Vietel CHT Compamy Ltd
11732 0.8% AS31898 Oracle Corporation
11479 0.7% AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.
10290 0.7% AS154383 ZORNTECH WEB SOLUTIONS
9422 0.6% AS63023 GTHost
8302 0.5% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.
481185 31.4% ... 1314 more
---------- ------ ---
1531053 100.0% 1334 distinct ASNs
== ASN by attempts per IP ==
(1243 ASNs with fewer than 10 IPs excluded)
att/IP IPs attempts ASNs
11107.9 14 155510 AS48090 TECHOFF SRV LIMITED
4077.8 110 448559 AS197170 TechTies Inc.
3371.1 22 74165 AS47890 UNMANAGED LTD
2989.4 25 74735 AS198364 BANATSYNC SRL
1067.5 33 35226 AS7713 Telekomunikasi Indonesia PT
327.5 18 5895 AS41745 Baykov Ilya Sergeevich
298.7 18 5377 AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP
282.0 92 25947 AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED
275.8 20 5516 AS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
228.6 83 18970 AS45102 Alibaba US Technology Co., Ltd.
226.9 15 3403 AS142002 Scloud Pte Ltd
204.7 37 7574 AS24940 Hetzner Online GmbH
195.5 11 2150 AS35100 Patrik Lagerman
192.3 61 11732 AS31898 Oracle Corporation
172.9 107 18503 AS16276 OVH SAS
171.8 10 1718 AS18403 FPT Telecom Company
157.6 22 3467 AS138608 Cloud Host Pte Ltd
155.7 43 6696 AS396982 Google LLC
149.7 139 20814 AS4837 CHINA UNICOM China169 Backbone
143.8 52 7479 AS36352 HostPapa
63.4 3536 224255 ... 71 more
---------- -------- ----------- ---
259.1 4468 1157691 91 distinct ASNs, average
(1243 ASNs with fewer than 10 IPs excluded)
Credentials #
Reminder: - Passwords and usernames are percent-encoded (like an URL) to provide the information lossless and fully reversible - use Cyberchef to reverse it.
# Top 20 Credentials
3861 root 123456
3508 root root
3449 root password
3273 root 12345678
3175 root admin
3003 root 1234
2827 root 12345
2753 admin admin
2601 ubuntu ubuntu
2538 root 123456789
2526 root 123
2492 root qwerty
2361 root root123
2342 ubuntu 123456
2201 admin 123456
2156 root 123123
2130 root toor
2091 root admin123
1993 root 1234567890
1988 root 1
[...]
# Top 20 Usernames
648133 root
67726 admin
42897 ubuntu
35157 user
17049 test
16412 debian
14273 deploy
9444 ftpuser
8223 solana
7622 postgres
7307 pi
7198 oracle
7177 dev
6235 user1
6188 guest
5993 claude
5991 git
5378 minecraft
5242 solv
5159 deployer
[...]
# Top 20 Passwords
73592 123456
37707 123
31432 1234
24847 password
23662 12345678
18938 12345
18849 1
17269 root
12340 123456789
11390 admin
9244 qwerty
8717 test
7793 P%40ssw0rd
6782 toor
6748 111111
6658 1234567890
6575 abc123
5816 123123
5514 ubuntu
5404 admin123
[..]
Sources: Access to complete list of July’s 2026 credentials:
- credential-pair-qty-2026-07
- credential-pair-unique-2026-07
- credential-username-qty-2026-07
- credential-username-unique-2026-07
- credential-password-qty-2026-07
- credential-password-unique-2026-07
Next versions will prob be included in the Git repos below - not yet sure!
Access to ALL credentials from the past months: - https://git.uphillsecurity.com/UphillSecurity/open-honeypot-data/
License - Creative Commons Attribution 4.0 International License (CC BY 4.0)
The Tech #
I’ll keep it simple - still a mess, but a top-level view might still be interesting.
Servers Management and Automation #
- Ubuntu Server 24.04 LTS or 26.04 LTS
- Automation with Ansible
- Onboarding
- User creation
- Installation required software
- Basic config
- Wireguard VPN Setup
- Config for connection to central management server
- FW rules
- SSH Setup
- SSHD listening only on VPN IP and Port 2222 (to avoid any conflicts)
- the usual hardening (public key, etc)
- Honeypot Setup
- Runs as a rootless Podman container (Systemd service via Quadlet)
- Port 22 as non-root with
net.ipv4.ip_unprivileged_port
Side note: Ansible can be a bitch.
The SSH Honeypot #
Found some open-source candidates but they were either too ‘old’ or bloated so I’ve decided to do myself with the help of AI. I’ve used Python and Paramiko for the SSH handling.
The source code - I might publish a manual and the Ansible/Podman Quadlet file.
In short: low-interaction honeypot for SSH that saves the logs locally. Gathering the logs is being done with Ansible as well.
Additionally IP Information #
Been using ipgeolocation.io to fetch the additional information about the GEO locations, ASN information, etc.
Not affiliated or sponsored.
Reports #
- Bash madness + LibreOffice (you don’t want to know)
The Future #
I’ve got some plans for this project - feel free to share your ideas as well.
- better presentation and more detailed analysis
- more automation (gathering, reporting)
- different honeypots (DB, web, FTP, etc)
- more servers and IPs
- IPv6?
- hashes for passwords
- cross references with password lists
- sharing intel with abuseIPDB and other projects
- informing provider
- live-dashboard
I’ve been working on a roadmap - but it will take a while.
Thank you for reading! As mentioned before, I’d like to hear your feedback or questions in the comments below.