Harvesting SSH Credentials: Insights from My Honeypot Network

Aug 03, 2026 12:45 AM - 2 hours ago 1

I’ve been moving connected this honeypot web for the past mates of months, and I’d now for illustration to stock immoderate accusation from the first 30 days.

In this article::

Intro and short summary
the Data - credentials, onslaught sources, and truthful on
the Tech - servers, automation, honeypot
the Future - immoderate plans and adjacent steps

The task is still work-in-progress and I scheme to amended it complete time. The position is still a small spot rough, but this will do for now.

Feedback and questions are welcome!

Intro #

Honeypot Map

Locations of honeypots

References for this article: - Timeframe = July 2026 - 15 servers (only dedicated for this purpose) - 15 IPs, IPv4 - each complete the world (see above) - 5 VPS Providers - SSH Honeypot, Port 22/TCP

The Data #

Some things to see earlier we start:

Most honeypots are presently successful Europe (60%) - I scheme to adhd more
Passwords and usernames are percent-encoded (like an URL) to supply the accusation lossless and afloat reversible - use Cyberchef to reverse it.
Only login attempts are considered - scans aliases different attacks are not (yet)!
I can’t people the IPs of the attackers arsenic I americium not yet acquainted pinch the privateness laws

Presentation is still rough, but will amended pinch adjacent versions.

Summary

Unique IPs: 6790 Total Login Attempts: 1,531,053 Unique Credentials: 131922 (Pair UN+PW) Unique Usernames: 12238 Unique Passwords: 97621

Attack IP Sources #

Continent

== Continent by unsocial IPs == IPs stock continents 4084 60.1% Asia 1294 19.1% Europe 832 12.3% North America 360 5.3% South America 190 2.8% Africa 30 0.4% Oceania ---------- ------ --- 6790 100.0% 6 chopped continents == Continent by login attempts == attempts stock continents 921439 60.2% Europe 453254 29.6% Asia 97441 6.4% North America 38604 2.5% South America 18793 1.2% Africa 1522 0.1% Oceania ---------- ------ --- 1531053 100.0% 6 chopped continents == Continent by attempts per IP == att/IP IPs attempts continents 712.1 1294 921439 Europe 117.1 832 97441 North America 111.0 4084 453254 Asia 107.2 360 38604 South America 98.9 190 18793 Africa 50.7 30 1522 Oceania ---------- -------- ----------- --- 225.5 6790 1531053 6 chopped continents, average

Country

== Country by unsocial IPs == IPs stock countries 1653 24.3% China 721 10.6% United States 458 6.7% India 338 5.0% Vietnam 286 4.2% South Korea 276 4.1% Netherlands 236 3.5% Hong Kong 206 3.0% Germany 184 2.7% Brazil 182 2.7% Russia 178 2.6% Singapore 169 2.5% Indonesia 162 2.4% France 134 2.0% Malaysia 123 1.8% Taiwan 78 1.1% Japan 78 1.1% United Kingdom 71 1.0% Sweden 55 0.8% Iran 53 0.8% Bangladesh 1149 16.9% ... 109 more ---------- ------ --- 6790 100.0% 129 chopped countries == Country by login attempts == attempts stock countries 686449 44.8% Netherlands 112793 7.4% China 72314 4.7% United States 70413 4.6% Indonesia 68810 4.5% Romania 46318 3.0% Vietnam 44404 2.9% Singapore 38194 2.5% India 32136 2.1% South Korea 31171 2.0% Germany 30740 2.0% Hong Kong 28103 1.8% France 19012 1.2% Mexico 17765 1.2% Brazil 15047 1.0% Japan 14221 0.9% Poland 13478 0.9% Finland 12366 0.8% Russia 12272 0.8% Switzerland 12001 0.8% Turkey 153046 10.0% ... 109 more ---------- ------ --- 1531053 100.0% 129 chopped countries == Country by attempts per IP == (74 countries pinch less than 10 IPs excluded) att/IP IPs attempts countries 2646.5 26 68810 Romania 2487.1 276 686449 Netherlands 721.9 17 12272 Switzerland 644.2 13 8374 Lithuania 446.5 16 7144 Peru 421.3 19 8005 Uzbekistan 421.2 32 13478 Finland 416.6 169 70413 Indonesia 414.4 25 10361 Spain 374.2 38 14221 Poland 372.8 51 19012 Mexico 315.7 11 3473 Nigeria 300.0 40 12001 Turkey 249.5 178 44404 Singapore 192.9 78 15047 Japan 185.3 53 9820 Bangladesh 173.5 162 28103 France 151.3 206 31171 Germany 150.6 78 11746 United Kingdom 139.7 55 7686 Iran 84.5 4995 422119 ... 35 more ---------- -------- ----------- --- 230.1 6538 1504109 55 chopped countries, average (74 countries pinch less than 10 IPs excluded)

ASN

== ASN by unsocial IPs == IPs stock ASNs 303 4.5% AS8075 Microsoft Corporation 280 4.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street 259 3.8% AS14061 DigitalOcean, LLC 212 3.1% AS4811 Shanghai Telecom Company 193 2.8% AS4766 Korea Telecom 182 2.7% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd. 163 2.4% AS137718 Beijing Volcano Engine Technology Co., Ltd. 139 2.0% AS4837 CHINA UNICOM China169 Backbone 115 1.7% AS4818 DiGi Telecommunications Sdn Bhd., Digi Internet Exchange 110 1.6% AS197170 TechTies Inc. 107 1.6% AS16276 OVH SAS 105 1.5% AS7552 Viettel Group 99 1.5% AS9808 China Mobile 92 1.4% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 84 1.2% AS132203 Shenzhen Tencent Computer Systems Company Limited 83 1.2% AS45102 Alibaba US Technology Co., Ltd. 73 1.1% AS24086 Viettel Corporation 69 1.0% AS37963 Hangzhou Alibaba Advertising Co.,Ltd. 61 0.9% AS31898 Oracle Corporation 57 0.8% AS17421 Chunghwa Telecom Co., Ltd. 4004 59.0% ... 1314 more ---------- ------ --- 6790 100.0% 1334 chopped ASNs == ASN by login attempts == attempts stock ASNs 448559 29.3% AS197170 TechTies Inc. 155510 10.2% AS48090 TECHOFF SRV LIMITED 74735 4.9% AS198364 BANATSYNC SRL 74165 4.8% AS47890 UNMANAGED LTD 35226 2.3% AS7713 Telekomunikasi Indonesia PT 29003 1.9% AS14061 DigitalOcean, LLC 25947 1.7% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 24795 1.6% AS63930 Ready Server Pte Ltd 22878 1.5% AS4766 Korea Telecom 20814 1.4% AS4837 CHINA UNICOM China169 Backbone 19120 1.2% AS8075 Microsoft Corporation 18970 1.2% AS45102 Alibaba US Technology Co., Ltd. 18503 1.2% AS16276 OVH SAS 16744 1.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street 13674 0.9% AS38731 Vietel CHT Compamy Ltd 11732 0.8% AS31898 Oracle Corporation 11479 0.7% AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V. 10290 0.7% AS154383 ZORNTECH WEB SOLUTIONS 9422 0.6% AS63023 GTHost 8302 0.5% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd. 481185 31.4% ... 1314 more ---------- ------ --- 1531053 100.0% 1334 chopped ASNs == ASN by attempts per IP == (1243 ASNs pinch less than 10 IPs excluded) att/IP IPs attempts ASNs 11107.9 14 155510 AS48090 TECHOFF SRV LIMITED 4077.8 110 448559 AS197170 TechTies Inc. 3371.1 22 74165 AS47890 UNMANAGED LTD 2989.4 25 74735 AS198364 BANATSYNC SRL 1067.5 33 35226 AS7713 Telekomunikasi Indonesia PT 327.5 18 5895 AS41745 Baykov Ilya Sergeevich 298.7 18 5377 AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP 282.0 92 25947 AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 275.8 20 5516 AS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP 228.6 83 18970 AS45102 Alibaba US Technology Co., Ltd. 226.9 15 3403 AS142002 Scloud Pte Ltd 204.7 37 7574 AS24940 Hetzner Online GmbH 195.5 11 2150 AS35100 Patrik Lagerman 192.3 61 11732 AS31898 Oracle Corporation 172.9 107 18503 AS16276 OVH SAS 171.8 10 1718 AS18403 FPT Telecom Company 157.6 22 3467 AS138608 Cloud Host Pte Ltd 155.7 43 6696 AS396982 Google LLC 149.7 139 20814 AS4837 CHINA UNICOM China169 Backbone 143.8 52 7479 AS36352 HostPapa 63.4 3536 224255 ... 71 more ---------- -------- ----------- --- 259.1 4468 1157691 91 chopped ASNs, average (1243 ASNs pinch less than 10 IPs excluded)

Credentials #

Reminder: - Passwords and usernames are percent-encoded (like an URL) to supply the accusation lossless and afloat reversible - use Cyberchef to reverse it.

# Top 20 Credentials 3861 guidelines 123456 3508 guidelines root 3449 guidelines password 3273 guidelines 12345678 3175 guidelines admin 3003 guidelines 1234 2827 guidelines 12345 2753 admin admin 2601 ubuntu ubuntu 2538 guidelines 123456789 2526 guidelines 123 2492 guidelines qwerty 2361 guidelines root123 2342 ubuntu 123456 2201 admin 123456 2156 guidelines 123123 2130 guidelines toor 2091 guidelines admin123 1993 guidelines 1234567890 1988 guidelines 1 [...] # Top 20 Usernames 648133 root 67726 admin 42897 ubuntu 35157 user 17049 test 16412 debian 14273 deploy 9444 ftpuser 8223 solana 7622 postgres 7307 pi 7198 oracle 7177 dev 6235 user1 6188 guest 5993 claude 5991 git 5378 minecraft 5242 solv 5159 deployer [...] # Top 20 Passwords 73592 123456 37707 123 31432 1234 24847 password 23662 12345678 18938 12345 18849 1 17269 root 12340 123456789 11390 admin 9244 qwerty 8717 test 7793 P%40ssw0rd 6782 toor 6748 111111 6658 1234567890 6575 abc123 5816 123123 5514 ubuntu 5404 admin123 [..]

Sources: Access to complete database of July’s 2026 credentials:

credential-pair-qty-2026-07
credential-pair-unique-2026-07
credential-username-qty-2026-07
credential-username-unique-2026-07
credential-password-qty-2026-07
credential-password-unique-2026-07

Next versions will prob beryllium included successful the Git repos beneath - not yet sure!

Access to ALL credentials from the past months: - https://git.uphillsecurity.com/UphillSecurity/open-honeypot-data/

License - Creative Commons Attribution 4.0 International License (CC BY 4.0)

The Tech #

I’ll support it elemental - still a mess, but a top-level position mightiness still beryllium interesting.

Servers Management and Automation #

Ubuntu Server 24.04 LTS aliases 26.04 LTS
Automation pinch Ansible
Onboarding
- User creation
- Installation required software
- Basic config
Wireguard VPN Setup
- Config for relationship to cardinal guidance server
- FW rules
SSH Setup
- SSHD listening only connected VPN IP and Port 2222 (to debar immoderate conflicts)
- the accustomed hardening (public key, etc)
Honeypot Setup
- Runs arsenic a rootless Podman instrumentality (Systemd work via Quadlet)
- Port 22 arsenic non-root pinch net.ipv4.ip_unprivileged_port

Side note: Ansible tin beryllium a bitch.

The SSH Honeypot #

Found immoderate open-source candidates but they were either excessively ‘old’ aliases bloated truthful I’ve decided to do myself pinch the thief of AI. I’ve utilized Python and Paramiko for the SSH handling.

The root code - I mightiness people a manual and the Ansible/Podman Quadlet file.

In short: low-interaction honeypot for SSH that saves the logs locally. Gathering the logs is being done pinch Ansible arsenic well.