Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: SSH Scanning Activity - SANS Internet Storm Center SSH Scanning Activity

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Please help us make this page better by submitting your own data. For details on how to submit your data see our diary blog post announcing this feature. https://github.com/jkakavas/kippo-pyshield

We now offer a Raspberry Pi setup! For instructions read our diary blog post announcing it and/or our later diary blog post explaining how to run a DShield Sensor inside docker on RasPi.

Top 10 Usernames Attempted Today
Username Attempts Percent
View More
Top 10 Usernames Attempted This Month
Username Attempts Percent
root 80,020,399 39.85%
admin 47,615,972 23.71%
sh 4,094,139 2.04%
guest 3,988,465 1.99%
user 3,816,245 1.90%
system 3,324,262 1.66%
support 2,708,923 1.35%
enable 1,993,662 0.99%
enable 1,884,927 0.94%
test 1,801,721 0.90%
View More
Top 20 Usernames Attempted This Year
Username Attempts Percent
root 145,368,134 46.84%
admin 15,220,838 4.90%
user 7,244,490 2.33%
test 4,139,450 1.33%
nproc 3,800,600 1.22%
ubuntu 1,782,267 0.57%
oracle 1,477,257 0.48%
guest 1,356,864 0.44%
support 1,346,822 0.43%
postgres 1,225,561 0.39%
ftpuser 1,030,093 0.33%
git 877,119 0.28%
administrator 775,168 0.25%
mysql 616,882 0.20%
ubnt 572,387 0.18%
testuser 514,828 0.17%
pi 482,901 0.16%
ftp 466,709 0.15%
test1 453,928 0.15%
user2 453,232 0.15%
View More
Usernames Attempted This Year By Character Length
Length Attempts Percent
1 760,752 0.25%
2 7,321,044 2.36%
3 15,832,998 5.10%
4 171,745,197 55.34%
5 41,169,857 13.27%
6 26,172,121 8.43%
7 19,133,362 6.17%
8 12,680,898 4.09%
9 6,415,914 2.07%
10 3,524,603 1.14%
11 1,557,932 0.50%
12 916,111 0.30%
13 1,362,702 0.44%
14 543,646 0.18%
15 147,000 0.05%
16 207,001 0.07%
17 110,782 0.04%
18 26,746 0.01%
19 267,234 0.09%
20 25,749 0.01%