Analysis of attacker activity related to SSH password cracking

Published results of the analysis of attacks related to password guessing on SSH servers. During the experiment, several honeypots were launched, impersonating an accessible OpenSSH server and deployed across various cloud provider networks such as
Google Cloud, DigitalOcean, and NameCheap. Over three months, a total of 929,554 connection attempts to the server were recorded.

In 78% of cases, the guessing was aimed at determining the root user password. The most frequently checked passwords were '123456' and 'password', but the list also included the password 'J5cmmu=Kyf0-br8CsW', likely used by some manufacturer by default.

Most popular usernames and passwords:

From the analyzed guessing attempts, 128,588 unique login-password pairs were identified, with 38,112 of them being tested 5 or more times. The 25 most frequently checked pairs:

Distribution of scanning attempts by days of the week and hours:

A total of 27,448 unique requests were recorded (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community..
The highest number of checks performed from a single IP was 64,969. The share of checks through Tor was only 0.8%. 62.2% of IP addresses involved in guessing attempts were associated with Chinese subnets:

Source: opennet.ru