Password guessing

One username, one password, one connection, then hang up and go again. That is most of what this honeypot, a machine that exists to be attacked, ever sees. A session is one of those connections, from hello to hangup.

From 9 to 15 October 2026 (UTC), 5,006,360 sessions made exactly one guess and failed. Most came from one router botnet, a crowd of infected machines taking orders from the same people: 124 addresses running its loader, the program that logs in and installs the bot, made 99.1% of the sessions in which every guess failed. Each is an IP address, the number a machine is reached at on the internet, and most likely belongs to someone's infected router, not to the person running the botnet [1].

More than 99 of every 100 guesses came in over telnet, the old way of logging in over the network, which sends the password as plain text. The rest came in over SSH, its encrypted replacement [2].

Twenty guesses from one bot

These are the first 20 guesses one address from the router botnet made on 9 October 2026, starting at midnight UTC. Every guess is its own connection, and all 20 were refused.

In the first 41 seconds of the day it had 122 guesses refused. The 123rd, username user and password user, was let in.

Why 122 and not five? The honeypot is rigged to let bots in, and it had let this address in the evening before. After that, only the pair it was let in with works for that address, or one of the last ten pairs it let anyone in with [3].

What it typed next is replayed on the router botnet page.

The passwords, and what they open

Factory passwords are not secret. Default logins for most devices are published online [4], and some are printed on a label on the device itself [5].

Researchers traced some of the 46 passwords in Mirai's 2016 source code to devices, mostly IP cameras, DVRs (the boxes that record camera footage) and routers [6]. Seven of the ten pairs guessed most often here that week use a password from that list.

Most guessed, 9 to 15 October 2026

Mirai's 2016 passwords, still tried here that week

They are not only Mirai's. Trend Micro found the SORA variant trying xc3511, vizxv, xmhdipc and hi3518 in 2020 [7][8], and IBM X-Force found Zte521 in the password list built into Mozi [9].

Nobody is guessing your birthday. They are guessing the label on the box.

How to stop it

Router, camera or anything with a factory login

• Change the default password. The defaults are published online [4].
• Turn telnet off [10], and turn off remote management, so the login only answers from inside your own network [5].
• If the password cannot be changed, keep the device off the open internet: no port forwarding to it, and a firewall that blocks addresses you have not allowed [11].
• Replace it when the maker stops sending updates [12][13].

How to check what your address shows the internet, and what to do about a device that is already infected, is on the router botnet page.

Server with SSH

• Use an SSH key instead of a password. It is a pair of files: you keep the private half, the public half goes on the server, and it logs you in without a password [2].
• Then turn passwords off with PasswordAuthentication no, in a file under /etc/ssh/sshd_config.d/, because OpenSSH allows them by default [14]. A mistake there can lock you out of a server you only reach over SSH [2]: the SSH key backdoor page shows how to do it safely, step by step.
• If a password has to stay, make it at least 15 characters and nothing from a list of common or breached passwords [15].

Why it works

CISA calls default credentials a top weakness that attackers exploit, and has told manufacturers to stop shipping them, because "relying upon thousands of customers to change their passwords is insufficient" [16].

Mirai proved it in 2016 with a list of 62 default logins [4][6]. Guessing alone gave it 200,000 to 300,000 infected devices in September 2016 [6].

From 29 April 2024 the UK banned easily guessable default passwords on smart devices [17]. Most of the passwords in the tables above were already in Mirai's list in 2016. The law is from 2024.

This week

Sources

1. Netlab 360 (Alex.Turing and Hui Wang), "Mozi, Another Botnet Using DHT", 23 December 2019. blog.netlab.360.com
2. Canonical, Ubuntu Server documentation, "OpenSSH server", updated 2 October 2026. ubuntu.com
3. Cowrie project, source code, "src/cowrie/core/auth.py, the AuthRandom login rule", version 3.0.13, tagged 24 August 2026. github.com
4. CISA, "Heightened DDoS Threat Posed by Mirai and Other Botnets", 14 October 2016, revised 17 October 2017. cisa.gov
5. CISA, "Home Network Security", released 1 February 2021. cisa.gov
6. USENIX Security Symposium (Antonakakis et al.), "Understanding the Mirai Botnet", August 2017. usenix.org
7. Trend Micro (Raymart Paraiso and Augusto Remillano II), "SORA and UNSTABLE: 2 Mirai Variants Target Video Surveillance Storage Systems", 5 February 2020. trendaisecurity.com
8. Trend Micro Threat Encyclopedia, "IoT.Linux.MIRAI.DLEU", 29 January 2020. trendmicro.com
9. IBM X-Force (Dave McMillen, Wei Gao and Charles DeBeck), "A New Botnet Attack Just Mozied Into Town", undated, covers October 2019 to June 2020. ibm.com
10. CISA, "Securing Network Infrastructure Devices", released 6 September 2006. cisa.gov
11. FBI, Internet Crime Complaint Center, "Cyber Actors Use Internet of Things Devices as Proxies for Anonymity and Pursuit of Malicious Cyber Activities", 2 August 2018. ic3.gov
12. UK National Cyber Security Centre, "Smart devices: using them safely in your home", 15 February 2019, reviewed 23 February 2024. ncsc.gov.uk
13. FBI, Internet Crime Complaint Center, "Cyber Criminal Proxy Services Exploiting End of Life Routers", 7 May 2025. ic3.gov
14. OpenBSD manual pages, "sshd_config(5)", read 16 October 2026. man.openbsd.org
15. NIST, "SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management", July 2025. pages.nist.gov
16. CISA, "Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords", December 2023. cisa.gov
17. UK Government, "New laws to protect consumers from cyber criminals come into force in the UK", 29 April 2024. gov.uk