Harvesting SSH Credentials: Insights from my Honeypot Network - Uphill Security

2026-08-02

Harvesting SSH Credentials: Insights from my Honeypot Network

I’ve been working on this honeypot network for the past couple of months, and I’d now like to share some information from the first 30 days.

In this article::

Intro and short summary
the Data - credentials, attack sources, and so on
the Tech - servers, automation, honeypot
the Future - some plans and next steps

The project is still work-in-progress and I plan to improve it over time. The presentation is still a little bit rough, but this will do for now.

Feedback and questions are welcome!

---

Intro

Honeypot Map

Locations of honeypots

References for this article:
Timeframe = July 2026
15 servers (only dedicated for this purpose)
15 IPs, IPv4
all over the world (see above)
5 VPS Providers
SSH Honeypot, Port 22/TCP

---

The Data

Some things to consider before we start:

Most honeypots are currently in Europe (60%) - I plan to add more
Passwords and usernames are percent-encoded (like an URL) to provide the information lossless and fully reversible - use Cyberchef to reverse it.
Only login attempts are considered - scans or other attacks are not (yet)!
I can’t publish the IPs of the attackers as I am not yet familiar with the privacy laws

Presentation is still rough, but will improve with next versions.

---

Summary

Unique IPs: 6790
Total Login Attempts: 1,531,053
Unique Credentials: 131922             (Pair UN+PW)
Unique Usernames: 12238
Unique Passwords: 97621

---

Attack IP Sources

#### Continent

== Continent by unique IPs == IPs share continents 4084 60.1% Asia 1294 19.1% Europe 832 12.3% North America 360 5.3% South America 190 2.8% Africa 30 0.4% Oceania ---------- ------ --- 6790 100.0% 6 distinct continents == Continent by login attempts == attempts share continents 921439 60.2% Europe 453254 29.6% Asia 97441 6.4% North America 38604 2.5% South America 18793 1.2% Africa 1522 0.1% Oceania ---------- ------ --- 1531053 100.0% 6 distinct continents

== Continent by attempts per IP == att/IP IPs attempts continents 712.1 1294 921439 Europe 117.1 832 97441 North America 111.0 4084 453254 Asia 107.2 360 38604 South America 98.9 190 18793 Africa 50.7 30 1522 Oceania ---------- -------- ----------- --- 225.5 6790 1531053 6 distinct continents, average

#### Country

== Country by unique IPs == IPs share countries 1653 24.3% China 721 10.6% United States 458 6.7% India 338 5.0% Vietnam 286 4.2% South Korea 276 4.1% Netherlands 236 3.5% Hong Kong 206 3.0% Germany 184 2.7% Brazil 182 2.7% Russia 178 2.6% Singapore 169 2.5% Indonesia 162 2.4% France 134 2.0% Malaysia 123 1.8% Taiwan 78 1.1% Japan 78 1.1% United Kingdom 71 1.0% Sweden 55 0.8% Iran 53 0.8% Bangladesh 1149 16.9% ... 109 more ---------- ------ --- 6790 100.0% 129 distinct countries == Country by login attempts == attempts share countries 686449 44.8% Netherlands 112793 7.4% China 72314 4.7% United States 70413 4.6% Indonesia 68810 4.5% Romania 46318 3.0% Vietnam 44404 2.9% Singapore 38194 2.5% India 32136 2.1% South Korea 31171 2.0% Germany 30740 2.0% Hong Kong 28103 1.8% France 19012 1.2% Mexico 17765 1.2% Brazil 15047 1.0% Japan 14221 0.9% Poland 13478 0.9% Finland 12366 0.8% Russia 12272 0.8% Switzerland 12001 0.8% Turkey 153046 10.0% ... 109 more ---------- ------ --- 1531053 100.0% 129 distinct countries == Country by attempts per IP == (74 countries with fewer than 10 IPs excluded) att/IP IPs attempts countries 2646.5 26 68810 Romania 2487.1 276 686449 Netherlands 721.9 17 12272 Switzerland 644.2 13 8374 Lithuania 446.5 16 7144 Peru 421.3 19 8005 Uzbekistan 421.2 32 13478 Finland 416.6 169 70413 Indonesia 414.4 25 10361 Spain 374.2 38 14221 Poland 372.8 51 19012 Mexico 315.7 11 3473 Nigeria 300.0 40 12001 Turkey 249.5 178 44404 Singapore 192.9 78 15047 Japan 185.3 53 9820 Bangladesh 173.5 162 28103 France 151.3 206 31171 Germany 150.6 78 11746 United Kingdom 139.7 55 7686 Iran 84.5 4995 422119 ... 35 more ---------- -------- ----------- --- 230.1 6538 1504109 55 distinct countries, average

(74 countries with fewer than 10 IPs excluded)

#### ASN

== ASN by unique IPs == IPs share ASNs 303 4.5% AS8075 Microsoft Corporation 280 4.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street 259 3.8% AS14061 DigitalOcean, LLC 212 3.1% AS4811 Shanghai Telecom Company 193 2.8% AS4766 Korea Telecom 182 2.7% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd. 163 2.4% AS137718 Beijing Volcano Engine Technology Co., Ltd. 139 2.0% AS4837 CHINA UNICOM China169 Backbone 115 1.7% AS4818 DiGi Telecommunications Sdn Bhd., Digi Internet Exchange 110 1.6% AS197170 TechTies Inc. 107 1.6% AS16276 OVH SAS 105 1.5% AS7552 Viettel Group 99 1.5% AS9808 China Mobile 92 1.4% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 84 1.2% AS132203 Shenzhen Tencent Computer Systems Company Limited 83 1.2% AS45102 Alibaba US Technology Co., Ltd. 73 1.1% AS24086 Viettel Corporation 69 1.0% AS37963 Hangzhou Alibaba Advertising Co.,Ltd. 61 0.9% AS31898 Oracle Corporation 57 0.8% AS17421 Chunghwa Telecom Co., Ltd. 4004 59.0% ... 1314 more ---------- ------ --- 6790 100.0% 1334 distinct ASNs == ASN by login attempts == attempts share ASNs 448559 29.3% AS197170 TechTies Inc. 155510 10.2% AS48090 TECHOFF SRV LIMITED 74735 4.9% AS198364 BANATSYNC SRL 74165 4.8% AS47890 UNMANAGED LTD 35226 2.3% AS7713 Telekomunikasi Indonesia PT 29003 1.9% AS14061 DigitalOcean, LLC 25947 1.7% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 24795 1.6% AS63930 Ready Server Pte Ltd 22878 1.5% AS4766 Korea Telecom 20814 1.4% AS4837 CHINA UNICOM China169 Backbone 19120 1.2% AS8075 Microsoft Corporation 18970 1.2% AS45102 Alibaba US Technology Co., Ltd. 18503 1.2% AS16276 OVH SAS 16744 1.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street 13674 0.9% AS38731 Vietel CHT Compamy Ltd 11732 0.8% AS31898 Oracle Corporation 11479 0.7% AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V. 10290 0.7% AS154383 ZORNTECH WEB SOLUTIONS 9422 0.6% AS63023 GTHost 8302 0.5% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd. 481185 31.4% ... 1314 more ---------- ------ --- 1531053 100.0% 1334 distinct ASNs == ASN by attempts per IP == (1243 ASNs with fewer than 10 IPs excluded) att/IP IPs attempts ASNs 11107.9 14 155510 AS48090 TECHOFF SRV LIMITED 4077.8 110 448559 AS197170 TechTies Inc. 3371.1 22 74165 AS47890 UNMANAGED LTD 2989.4 25 74735 AS198364 BANATSYNC SRL 1067.5 33 35226 AS7713 Telekomunikasi Indonesia PT 327.5 18 5895 AS41745 Baykov Ilya Sergeevich 298.7 18 5377 AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP 282.0 92 25947 AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 275.8 20 5516 AS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP 228.6 83 18970 AS45102 Alibaba US Technology Co., Ltd. 226.9 15 3403 AS142002 Scloud Pte Ltd 204.7 37 7574 AS24940 Hetzner Online GmbH 195.5 11 2150 AS35100 Patrik Lagerman 192.3 61 11732 AS31898 Oracle Corporation 172.9 107 18503 AS16276 OVH SAS 171.8 10 1718 AS18403 FPT Telecom Company 157.6 22 3467 AS138608 Cloud Host Pte Ltd 155.7 43 6696 AS396982 Google LLC 149.7 139 20814 AS4837 CHINA UNICOM China169 Backbone 143.8 52 7479 AS36352 HostPapa 63.4 3536 224255 ... 71 more ---------- -------- ----------- --- 259.1 4468 1157691 91 distinct ASNs, average

(1243 ASNs with fewer than 10 IPs excluded)

---

Credentials

Reminder: - Passwords and usernames are percent-encoded (like an URL) to provide the information lossless and fully reversible - use Cyberchef to reverse it.

# Top 20 Credentials
3861    root    123456
3508    root    root
3449    root    password
3273    root    12345678
3175    root    admin
3003    root    1234
2827    root    12345
2753    admin   admin
2601    ubuntu  ubuntu
2538    root    123456789
2526    root    123
2492    root    qwerty
2361    root    root123
2342    ubuntu  123456
2201    admin   123456
2156    root    123123
2130    root    toor
2091    root    admin123
1993    root    1234567890
1988    root    1
[...]
Top 20 Usernames
648133  root
67726   admin
42897   ubuntu
35157   user
17049   test
16412   debian
14273   deploy
9444    ftpuser
8223    solana
7622    postgres
7307    pi
7198    oracle
7177    dev
6235    user1
6188    guest
5993    claude
5991    git
5378    minecraft
5242    solv
5159    deployer
[...]
Top 20 Passwords
73592   123456
37707   123
31432   1234
24847   password
23662   12345678
18938   12345
18849   1
17269   root
12340   123456789
11390   admin
9244    qwerty
8717    test
7793    P%40ssw0rd
6782    toor
6748    111111
6658    1234567890
6575    abc123
5816    123123
5514    ubuntu
5404    admin123
[..]

Sources: Access to complete list of July’s 2026 credentials:

credential-pair-qty-2026-07
credential-pair-unique-2026-07
credential-username-qty-2026-07
credential-username-unique-2026-07
credential-password-qty-2026-07
credential-password-unique-2026-07

Next versions will prob be included in the Git repos below - not yet sure!

Access to ALL credentials from the past months: - https://git.uphillsecurity.com/UphillSecurity/open-honeypot-data/

License - Creative Commons Attribution 4.0 International License (CC BY 4.0)

---

The Tech

I’ll keep it simple - still a mess, but a top-level view might still be interesting.

Servers Management and Automation

Ubuntu Server 24.04 LTS or 26.04 LTS
Automation with Ansible
Onboarding
Wireguard VPN Setup
SSH Setup
Honeypot Setup

(Systemd service via Quadlet)

Side note: Ansible can be a bitch.

The SSH Honeypot

Found some open-source candidates but they were either too ‘old’ or bloated so I’ve decided to do myself with the help of AI. I’ve used Python and Paramiko for the SSH handling.

The source code \- I might publish a manual and the Ansible/Podman Quadlet file.

In short: low-interaction honeypot for SSH that saves the logs locally. Gathering the logs is being done with Ansible as well.

Additionally IP Information

Been using ipgeolocation.io to fetch the additional information about the GEO locations, ASN information, etc.

Not affiliated or sponsored.

Reports

Bash madness + LibreOffice (you don’t want to know)

---

The Future

I’ve got some plans for this project - feel free to share your ideas as well.

better presentation and more detailed analysis
more automation (gathering, reporting)
different honeypots (DB, web, FTP, etc)
more servers and IPs
IPv6?
hashes for passwords
cross references with password lists
sharing intel with abuseIPDB and other projects
informing provider
live-dashboard

I’ve been working on a roadmap \- but it will take a while.

---

Thank you for reading! As mentioned before, I’d like to hear your feedback or questions in the comments below.

We are live again. 2025-11-08

Harvesting SSH Credentials: Insights from my Honeypot Network - Uphill Security

Harvesting SSH Credentials: Insights from my Honeypot Network - Uphill Security