This site is wired to a honeypot, a decoy server that accepts the internet's unsolicited login attempts and writes them down. Nobody was told it exists. The first attack arrived 23 seconds after it went live, and it has not been quiet since. Nothing here is targeted; every attempt comes from a bot working its way through the whole internet.
updated 2026-09-22 09:52 UTC · refreshes automatically
Everything on this page is automated background noise. No human chose this machine; botnets scan the entire internet and try default passwords on whatever answers. This machine just wrote it down. If you put a server online with password authentication and a guessable credential, this traffic finds it, usually within the hour.
So none of this took a skilled attacker, and the numbers below are not threat intelligence. What they measure is the baseline: how hostile the open internet is, and how little it takes to get compromised by accident.
There is no quiet hour. The botnets doing this are spread across every timezone and never stop; the dips and spikes come from campaigns starting and ending, not from anyone's working day.
| # | Source country | Attempts | Share |
|---|---|---|---|
| 01 | United States | 187,659 | 44.1% |
| 02 | Netherlands | 90,406 | 21.2% |
| 03 | Germany | 18,604 | 4.4% |
| 04 | Singapore | 15,447 | 3.6% |
| 05 | China | 14,190 | 3.3% |
| 06 | France | 11,047 | 2.6% |
| 07 | United Kingdom | 10,182 | 2.4% |
| 08 | Indonesia | 7,797 | 1.8% |
| 09 | India | 7,081 | 1.7% |
| 10 | Andorra | 6,496 | 1.5% |
| AS197170 | TechTies Inc. | 210,700 |
| AS398101 | GoDaddy.com, LLC | 181,882 |
| AS14061 | DigitalOcean, LLC | 142,657 |
| AS198364 | BANATSYNC SRL | 90,191 |
| AS47890 | UNMANAGED LTD | 62,987 |
| AS4837 | CHINA UNICOM China169 Backbone | 32,883 |
| AS213790 | Limited Network LTD | 30,556 |
| AS48090 | TECHOFF SRV LIMITED | 26,561 |
| AS206264 | Amarutu Technology Ltd | 23,651 |
| AS24940 | Hetzner Online GmbH | 20,548 |
Country and network tell you where infected machines and cheap VPSes are, not where an “attacker” sits. A large share of this traffic is compromised devices whose owners have no idea.
The sensor listens on both address families. IPv4 is scanned by mature botnets that can sweep its smaller address space cheaply; IPv6 is vast enough that blind scanning is far less practical. This is a comparison of traffic that reached this one sensor, not a measure of either protocol's security.
| # | Username / password | Tries |
|---|---|---|
| 01 | enable\x00/linuxshell\x00 | 45,198 |
| 02 | system\x00/shell\x00 | 40,974 |
| 03 | sh\x00//bin/busybox UNSTABLE\x00 | 14,875 |
| 04 | admin/admin | 4,407 |
| 05 | root/xc3511 | 4,001 |
| 06 | root/admin | 3,707 |
| 07 | root/root | 3,670 |
| 08 | root/vizxv | 3,636 |
| 09 | support/support | 3,336 |
| 10 | root/123456 | 2,698 |
| 11 | root/888888 | 2,320 |
| 12 | root/default | 2,182 |
| 13 | root/12345 | 2,176 |
| 14 | root/xmhdipc | 2,039 |
| 15 | root/juantech | 2,033 |
| 16 | root/ | 1,982 |
| 17 | root/54321 | 1,958 |
| 18 | user/user | 1,933 |
| 19 | admin/password | 1,901 |
| 20 | admin/ | 1,535 |
| 01 | root | 135,341 |
| 02 | enable\x00 | 45,788 |
| 03 | system\x00 | 40,974 |
| 04 | admin | 27,085 |
| 05 | sh\x00 | 14,875 |
| 06 | ubuntu | 7,354 |
| 07 | user | 6,666 |
| 08 | support | 3,890 |
| 09 | deploy | 3,080 |
| 10 | test | 3,011 |
| 01 | linuxshell\x00 | 45,198 |
| 02 | shell\x00 | 40,974 |
| 03 | 123456 | 15,282 |
| 04 | /bin/busybox UNSTABLE\x00 | 14,875 |
| 05 | admin | 8,899 |
| 06 | 123 | 6,622 |
| 07 | password | 6,554 |
| 08 | 1234 | 6,524 |
| 09 | root | 5,718 |
| 10 | 12345 | 5,217 |
| 01 | SSH-2.0-Go | 184,044 |
| 02 | SSH-2.0-libssh_0.9.6 | 44,996 |
| 03 | SSH-2.0-libssh_0.11.1 | 2,844 |
| 04 | SSH-2.0-PuTTY_Release_0.84 | 2,359 |
| 05 | SSH-2.0-libssh2_1.11.0 | 1,388 |
| 06 | SSH-2.0-AsyncSSH_2.1.0 | 966 |
| 07 | SSH-2.0-libssh_0.12.0 | 634 |
| 08 | SSH-2.0-libssh2_1.11.1 | 235 |
There is no clever exploit here, just dictionaries. The bots try root/123456 because somewhere out there it still works often enough to keep a botnet growing.
Each captured behavior is classified against MITRE ATT&CK, the shared vocabulary defenders use to talk about attacker techniques. The mapping is deliberately conservative: a technique is only counted when the event is direct evidence of it (the classifier and its tests are open source).
| Technique | Tactic | Observed |
|---|---|---|
| T1110.001 Brute Force: Password Guessing | Credential Access | 426,001 |
| T1021.004 Remote Services: SSH | Lateral Movement | 254,192 |
| T1059.004 Command and Scripting Interpreter: Unix Shell | Execution | 143,717 |
| T1021 Remote Services (Telnet) | Lateral Movement | 92,724 |
| T1078.001 Valid Accounts: Default Accounts | Initial Access | 19,641 |
| T1082 System Information Discovery | Discovery | 14,917 |
| T1222.002 File and Directory Permissions Modification | Defense Evasion | 8,816 |
| T1105 Ingress Tool Transfer | Command and Control | 6,686 |
| T1057 Process Discovery | Discovery | 1,751 |
| T1098.004 Account Manipulation: SSH Authorized Keys | Persistence | 1,317 |
| T1053.003 Scheduled Task/Job: Cron | Persistence | 1,270 |
| T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow | Credential Access | 65 |
| T1016 System Network Configuration Discovery | Discovery | 50 |
| T1070 Indicator Removal | Defense Evasion | 9 |
Counts are events, not incidents. A single bot session typically produces one connection, a burst of password guesses, and, if it gets a shell, a short scripted run of discovery, payload download, and persistence attempts. The shell it gets here is fake.
Endless dictionaries of common passwords against root and admin. Volume does the work.
Stopped by: disabling password authentication entirely (PasswordAuthentication no) and using SSH keys. Fail2ban and rate limiting cut the noise, but key-only auth is what ends the game.
pi/raspberry, ubnt/ubnt: devices shipped with documented logins and never changed.
Stopped by: changing or disabling default accounts before the machine ever faces the network. Treat first boot as part of deployment, not a TODO.
After a “successful” login: wget a payload to /tmp, chmod 777, run it. Usually a Mirai variant or a cryptominer.
Stopped by: egress filtering (servers rarely need arbitrary outbound HTTP), noexec on world-writable mounts, and alerting on new executables.
Appending an attacker key to authorized_keys or installing a cron entry, so the bot can come back even after a password change.
Stopped by: file-integrity monitoring on ~/.ssh and cron directories (auditd, Wazuh), and alerting on authorized_keys changes you didn't make.
uname -a, cat /proc/cpuinfo, cat /etc/passwd: the bot sizing up the machine for mining profitability or botnet duty.
Stopped by: everything above. Once recon runs, the machine is already compromised; prevention happens at authentication and exposure. What this row gives you is a tripwire.
All of this traffic exists because port 22 answered. Most machines don't need SSH reachable from the entire internet.
Stopped by: not exposing SSH publicly. Use WireGuard, an IP allowlist, or a bastion host. Moving to a nonstandard port only reduces the noise; scanners check those too.
The sensor is Cowrie, an established honeypot that emulates an SSH/Telnet server with a fake shell, so attackers interact with a recording rather than a real system. It runs on an isolated, disposable host with outbound traffic firewalled to a single telemetry channel, and holds no credentials for anything real.
Events flow one way: sensor → authenticated ingest API → database → pre-aggregated rollups → this page. The site you are reading never connects to the honeypot and renders only aggregate data. Full architecture, threat model, and runbook are on GitHub.
Source IP addresses are personal data under GDPR and are treated accordingly: at ingest they are replaced with a keyed pseudonym (HMAC) and a truncated network prefix (/24 or /48). Raw IPs are never stored or displayed. Raw event records are deleted after 30 days; the numbers on this page are anonymous lifetime aggregates, folded once from each event and kept with no per-source data behind them.
Captured usernames, passwords, and commands shown here were typed by automated tooling at a decoy machine. This site sets no cookies. It uses Vercel Web Analytics for anonymous, aggregate page-view statistics. Geolocation for attack traffic is resolved from database files held on the server, so an observed attack address is never sent to a third party; the pseudonymized event store is hosted on Kastro Labs' self-managed Coolify infrastructure in the EU. Country and network data from DB-IP (CC BY 4.0). Questions: andri.is.