The record,
in numbers.
Every table below comes from the anonymous rollup payload captured on 2026-09-25 14:52 UTC. Leaderboards are limited by the source API; they do not contain every observed value.
Daily activity
Lifetime daily counts, preserved after the 30-day raw-event purge. The first and last days are partial days.
View all 51 daily counts
| Date (UTC) | Login attempts |
|---|---|
| 2026-08-06 | 2,351 |
| 2026-08-07 | 8,442 |
| 2026-08-08 | 10,020 |
| 2026-08-09 | 12,826 |
| 2026-08-10 | 9,632 |
| 2026-08-11 | 8,814 |
| 2026-08-12 | 4,751 |
| 2026-08-13 | 6,784 |
| 2026-08-14 | 8,804 |
| 2026-08-15 | 6,720 |
| 2026-08-16 | 6,277 |
| 2026-08-17 | 4,824 |
| 2026-08-18 | 4,858 |
| 2026-08-19 | 4,533 |
| 2026-08-20 | 6,286 |
| 2026-08-21 | 19,083 |
| 2026-08-22 | 14,198 |
| 2026-08-23 | 7,800 |
| 2026-08-24 | 5,051 |
| 2026-08-25 | 4,508 |
| 2026-08-26 | 6,457 |
| 2026-08-27 | 11,886 |
| 2026-08-28 | 38,737 |
| 2026-08-29 | 9,443 |
| 2026-08-30 | 13,497 |
| 2026-08-31 | 2,601 |
| 2026-09-01 | 8,638 |
| 2026-09-02 | 6,492 |
| 2026-09-03 | 4,721 |
| 2026-09-04 | 5,685 |
| 2026-09-05 | 6,690 |
| 2026-09-06 | 5,882 |
| 2026-09-07 | 6,848 |
| 2026-09-08 | 5,689 |
| 2026-09-09 | 9,320 |
| 2026-09-10 | 25,145 |
| 2026-09-11 | 9,068 |
| 2026-09-12 | 10,691 |
| 2026-09-13 | 8,401 |
| 2026-09-14 | 9,925 |
| 2026-09-15 | 6,162 |
| 2026-09-16 | 11,440 |
| 2026-09-17 | 4,152 |
| 2026-09-18 | 8,078 |
| 2026-09-19 | 6,093 |
| 2026-09-20 | 11,845 |
| 2026-09-21 | 13,189 |
| 2026-09-22 | 5,805 |
| 2026-09-23 | 11,798 |
| 2026-09-24 | 6,252 |
| 2026-09-25 | 3,443 |
Source geography
Country is inferred from the source address at ingest using a local GeoIP database. It describes network location, not operator nationality or physical location.
| Country | Attempts | Share |
|---|---|---|
| United States | 203,528 | 45.2% |
| Netherlands | 91,317 | 20.3% |
| Germany | 18,943 | 4.2% |
| Singapore | 15,587 | 3.5% |
| China | 15,082 | 3.3% |
| France | 11,188 | 2.5% |
| United Kingdom | 10,808 | 2.4% |
| Indonesia | 7,970 | 1.8% |
| India | 7,275 | 1.6% |
| Andorra | 7,055 | 1.6% |
| Vietnam | 6,340 | 1.4% |
| South Korea | 4,698 | 1.0% |
| Brazil | 4,462 | 1.0% |
| Canada | 4,384 | 1.0% |
| Finland | 4,317 | 1.0% |
| Hong Kong SAR China | 3,051 | 0.7% |
| Russia | 2,805 | 0.6% |
| Türkiye | 2,398 | 0.5% |
| Ukraine | 2,137 | 0.5% |
| Argentina | 1,587 | 0.4% |
| Bangladesh | 1,570 | 0.3% |
| Mexico | 1,439 | 0.3% |
| Italy | 1,242 | 0.3% |
| Sweden | 1,185 | 0.3% |
| Taiwan | 1,091 | 0.2% |
| Malaysia | 1,048 | 0.2% |
| Pakistan | 859 | 0.2% |
| Japan | 825 | 0.2% |
| Spain | 807 | 0.2% |
| Poland | 697 | 0.2% |
| Kenya | 668 | 0.1% |
| Iran | 629 | 0.1% |
| Chile | 623 | 0.1% |
| Ecuador | 592 | 0.1% |
| Thailand | 581 | 0.1% |
| Philippines | 575 | 0.1% |
| South Africa | 558 | 0.1% |
| Romania | 539 | 0.1% |
| Belgium | 511 | 0.1% |
| Nigeria | 494 | 0.1% |
| Bulgaria | 439 | 0.1% |
| Australia | 418 | 0.1% |
| Kazakhstan | 394 | 0.1% |
| Venezuela | 357 | 0.1% |
| Colombia | 356 | 0.1% |
| Morocco | 338 | 0.1% |
| Macao SAR China | 281 | 0.1% |
| Portugal | 277 | 0.1% |
| Norway | 274 | 0.1% |
| Bolivia | 266 | 0.1% |
| Algeria | 259 | 0.1% |
| Luxembourg | 239 | 0.1% |
| Uzbekistan | 230 | 0.1% |
| Egypt | 226 | 0.1% |
| Peru | 208 | 0.0% |
| Myanmar (Burma) | 184 | 0.0% |
| Ireland | 180 | 0.0% |
| Slovenia | 173 | 0.0% |
| Austria | 147 | 0.0% |
| Paraguay | 145 | 0.0% |
| Puerto Rico | 137 | 0.0% |
| Tanzania | 136 | 0.0% |
| Sri Lanka | 119 | 0.0% |
| United Arab Emirates | 118 | 0.0% |
| Panama | 115 | 0.0% |
| Mongolia | 113 | 0.0% |
| Hungary | 111 | 0.0% |
| Latvia | 110 | 0.0% |
| Czechia | 109 | 0.0% |
| Armenia | 103 | 0.0% |
| Georgia | 95 | 0.0% |
| Senegal | 91 | 0.0% |
| Cameroon | 89 | 0.0% |
| Azerbaijan | 88 | 0.0% |
| Rwanda | 85 | 0.0% |
| Estonia | 84 | 0.0% |
| Iraq | 84 | 0.0% |
| Cuba | 81 | 0.0% |
| Uganda | 81 | 0.0% |
| Ghana | 81 | 0.0% |
| Zimbabwe | 77 | 0.0% |
| Croatia | 75 | 0.0% |
| Malawi | 75 | 0.0% |
| Uruguay | 73 | 0.0% |
| Cyprus | 69 | 0.0% |
| Cambodia | 64 | 0.0% |
| Tunisia | 62 | 0.0% |
| Israel | 61 | 0.0% |
| Switzerland | 57 | 0.0% |
| Syria | 56 | 0.0% |
| Nepal | 55 | 0.0% |
| Afghanistan | 54 | 0.0% |
| Namibia | 52 | 0.0% |
| Laos | 52 | 0.0% |
| Kuwait | 52 | 0.0% |
| Isle of Man | 49 | 0.0% |
| Dominican Republic | 49 | 0.0% |
| Libya | 48 | 0.0% |
| Palestinian Territories | 45 | 0.0% |
| Moldova | 43 | 0.0% |
| Albania | 41 | 0.0% |
| Slovakia | 41 | 0.0% |
| El Salvador | 38 | 0.0% |
| Zambia | 37 | 0.0% |
| Botswana | 35 | 0.0% |
| Mozambique | 29 | 0.0% |
| North Macedonia | 28 | 0.0% |
| Belarus | 27 | 0.0% |
| Guatemala | 27 | 0.0% |
| Denmark | 26 | 0.0% |
| Lithuania | 21 | 0.0% |
| Greece | 18 | 0.0% |
| Serbia | 17 | 0.0% |
| Saudi Arabia | 15 | 0.0% |
| Malta | 13 | 0.0% |
| Jordan | 12 | 0.0% |
| Congo - Kinshasa | 12 | 0.0% |
| Madagascar | 12 | 0.0% |
| Oman | 11 | 0.0% |
| Togo | 10 | 0.0% |
| Costa Rica | 8 | 0.0% |
| Bosnia & Herzegovina | 7 | 0.0% |
| Ethiopia | 7 | 0.0% |
| Qatar | 7 | 0.0% |
| Nicaragua | 6 | 0.0% |
| Lebanon | 6 | 0.0% |
| Eritrea | 6 | 0.0% |
| Angola | 5 | 0.0% |
| Réunion | 5 | 0.0% |
| Trinidad & Tobago | 5 | 0.0% |
| St. Martin | 5 | 0.0% |
| Kyrgyzstan | 4 | 0.0% |
| Congo - Brazzaville | 4 | 0.0% |
| Burkina Faso | 4 | 0.0% |
| Maldives | 3 | 0.0% |
| Curaçao | 3 | 0.0% |
| Burundi | 3 | 0.0% |
| Mauritania | 3 | 0.0% |
| New Zealand | 3 | 0.0% |
| Guadeloupe | 3 | 0.0% |
| Brunei | 3 | 0.0% |
| Bahrain | 3 | 0.0% |
| Cape Verde | 2 | 0.0% |
| Kosovo | 2 | 0.0% |
| Gabon | 2 | 0.0% |
| French Guiana | 1 | 0.0% |
| Mauritius | 1 | 0.0% |
GeoIP data: DB-IP Lite, CC BY 4.0, queried locally at ingest. Network ASNs are counted across all event types; their totals use a different denominator and should not be compared directly with the login-attempt country table.
View top source networks
| ASN | Organization | Events |
|---|---|---|
| AS197170 | TechTies Inc. | 210,803 |
| AS398101 | GoDaddy.com, LLC | 194,365 |
| AS14061 | DigitalOcean, LLC | 152,325 |
| AS198364 | BANATSYNC SRL | 90,233 |
| AS47890 | UNMANAGED LTD | 67,392 |
| AS4837 | CHINA UNICOM China169 Backbone | 33,381 |
| AS213790 | Limited Network LTD | 31,091 |
| AS48090 | TECHOFF SRV LIMITED | 28,848 |
| AS206264 | Amarutu Technology Ltd | 23,651 |
| AS24940 | Hetzner Online GmbH | 20,548 |
Credential attempts
Top 20 username/password pairs from login-attempt events. The visible backslash-x-zero sequences are literal characters in the recorded strings, so we preserve them without silently interpreting them as control bytes.
| Username | Password | Attempts |
|---|---|---|
enable\x00 | linuxshell\x00 | 47,903 |
system\x00 | shell\x00 | 43,409 |
sh\x00 | /bin/busybox UNSTABLE\x00 | 15,010 |
admin | admin | 4,813 |
root | xc3511 | 4,262 |
root | root | 4,158 |
root | admin | 3,976 |
root | vizxv | 3,870 |
support | support | 3,568 |
root | 123456 | 2,878 |
root | 888888 | 2,464 |
root | 12345 | 2,310 |
root | default | 2,299 |
root | (empty) | 2,219 |
root | xmhdipc | 2,177 |
root | juantech | 2,146 |
root | 54321 | 2,092 |
user | user | 2,040 |
admin | password | 2,039 |
root | anko | 1,649 |
Top usernames
| Username | Attempts |
|---|---|
root | 143,977 |
enable\x00 | 48,684 |
system\x00 | 43,409 |
admin | 28,763 |
sh\x00 | 15,010 |
ubuntu | 7,733 |
user | 7,017 |
support | 4,162 |
deploy | 3,290 |
test | 3,173 |
Top passwords
| Password | Attempts |
|---|---|
linuxshell\x00 | 47,903 |
shell\x00 | 43,409 |
123456 | 16,267 |
/bin/busybox UNSTABLE\x00 | 15,010 |
admin | 9,620 |
123 | 7,014 |
1234 | 6,948 |
password | 6,921 |
root | 6,329 |
12345 | 5,517 |
Client banners
The most common self-reported SSH client version strings. A banner can be spoofed and does not identify a unique tool, bot, or person.
| Client banner | Events |
|---|---|
SSH-2.0-Go | 194,833 |
SSH-2.0-libssh_0.9.6 | 47,836 |
SSH-2.0-libssh_0.11.1 | 2,963 |
SSH-2.0-PuTTY_Release_0.84 | 2,521 |
SSH-2.0-libssh2_1.11.0 | 1,479 |
SSH-2.0-AsyncSSH_2.1.0 | 966 |
SSH-2.0-libssh_0.12.0 | 707 |
SSH-2.0-libssh2_1.11.1 | 249 |
Observed techniques
Event-level classifications using MITRE ATT&CK labels. One interaction can yield several classified events. Counts are not unique incidents or confirmed compromises.
| Technique | Tactic | Events |
|---|---|---|
| T1110.001 Brute Force: Password Guessing | Credential Access | 450,635 |
| T1021.004 Remote Services: SSH | Lateral Movement | 269,098 |
| T1059.004 Command and Scripting Interpreter: Unix Shell | Execution | 154,407 |
| T1021 Remote Services (Telnet) | Lateral Movement | 100,049 |
| T1078.001 Valid Accounts: Default Accounts | Initial Access | 20,633 |
| T1082 System Information Discovery | Discovery | 16,146 |
| T1222.002 File and Directory Permissions Modification | Defense Evasion | 10,858 |
| T1105 Ingress Tool Transfer | Command and Control | 6,993 |
| T1057 Process Discovery | Discovery | 1,867 |
| T1098.004 Account Manipulation: SSH Authorized Keys | Persistence | 1,441 |
| T1053.003 Scheduled Task/Job: Cron | Persistence | 1,382 |
| T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow | Credential Access | 71 |
| T1016 System Network Configuration Discovery | Discovery | 52 |
| T1070 Indicator Removal | Defense Evasion | 9 |
Reading this archive
Lifetime login attempts: 450,635. Distinct pseudonymized sources: 12,337. Successful decoy logins: 20,633. Sessions: 369,147. Fake-shell commands: 154,407.
The last-24-hour counters and 48-hour hourly series are deliberately omitted because they become misleading after collection ends. The underlying JSON snapshot is available for download.