Harvesting SSH Credentials: Insights from My Honeypot Network

3 hours ago

A honeypot network of 15 SSH servers worldwide collected 1.5 million login attempts from 6,790 unique IPs over 30 days.
Asia contributed the most unique IPs (60.1%), but Europe generated the highest login attempts (60.2%) largely due to the Netherlands.
China, the US, and India were the top three source countries by unique IPs; the Netherlands alone accounted for 44.8% of total attempts.
Top ASNs by attempts include TechTies Inc. (29.3%) and TECHOFF SRV LIMITED (10.2%), indicating concentrated attack infrastructure.
The most common credentials were weak pairs like 'root/123456', 'root/root', and 'root/password'; 'root' was the top username (648k attempts).
The honeypot runs as a rootless Podman container on Ubuntu, automated via Ansible with WireGuard VPN and IP geolocation enrichment.
Future plans include more honeypot types (DB, web, FTP), IPv6 support, live dashboards, and sharing intel with abuseIPDB.

80-90% of honeypot hits originate from IP addresses not on existing threat monitoring lists, indicating widespread unknown malicious traffic.
Global distribution of flagged IP addresses spans 229 countries, with high rates in countries like Bangladesh (29.9%) and Ukraine (27.6%), showing this is a worldwide issue.
Compromised smart appliances likely contribute to proxy networks, driving much of this traffic, and addressing it requires global coordinated action.

UK requires datacenters to pay refundable fees for grid connection requests to deter frivolous applications.
New storage-inspired high-bandwidth flash memory could enable GPUs with multiple TB capacity, though not without challenges.
Open source project ShieldFont uses poisoned fonts to protect text from AI scrapers.

High-bandwidth flash memory technology could enable GPUs with multiple TB capacity, combining SSD-like capacities with HBM-like speeds.
ShieldFont, an open source project, poisons fonts to fool AI scrapers and protect text content.
For the first time, the majority of corporate IT workloads are now off-premises, according to a survey.

New storage-inspired memory tech could enable GPUs with multiple TB of high-bandwidth flash, combining SSD capacities with HBM-like speeds.
Open source project ShieldFont uses poisoned fonts to fool AI scrapers and protect copy.
For the first time, majority of corporate IT workloads are now off-premises, according to a survey.

OpenAI launches 'Presence' consulting service to deploy AI agents, suggesting margins lie in implementation as models commoditize.
A Windows stealer malware targets over 300 apps and uses an AI profiler to maximize profits for criminals.
Chinese open-source AI models are now competitive globally, challenging assumptions about superiority.

80-90% of honeypot hits originate from IP addresses not on existing threat monitoring lists, indicating widespread unknown malicious traffic.
Global distribution of flagged IP addresses spans 229 countries, with high rates in countries like Bangladesh (29.9%) and Ukraine (27.6%), showing this is a worldwide issue.
Compromised smart appliances likely contribute to proxy networks, driving much of this traffic, and addressing it requires global coordinated action.

UK requires datacenters to pay refundable fees for grid connection requests to deter frivolous applications.
New storage-inspired high-bandwidth flash memory could enable GPUs with multiple TB capacity, though not without challenges.
Open source project ShieldFont uses poisoned fonts to protect text from AI scrapers.

High-bandwidth flash memory technology could enable GPUs with multiple TB capacity, combining SSD-like capacities with HBM-like speeds.
ShieldFont, an open source project, poisons fonts to fool AI scrapers and protect text content.
For the first time, the majority of corporate IT workloads are now off-premises, according to a survey.

New storage-inspired memory tech could enable GPUs with multiple TB of high-bandwidth flash, combining SSD capacities with HBM-like speeds.
Open source project ShieldFont uses poisoned fonts to fool AI scrapers and protect copy.
For the first time, majority of corporate IT workloads are now off-premises, according to a survey.

OpenAI launches 'Presence' consulting service to deploy AI agents, suggesting margins lie in implementation as models commoditize.
A Windows stealer malware targets over 300 apps and uses an AI profiler to maximize profits for criminals.
Chinese open-source AI models are now competitive globally, challenging assumptions about superiority.

Hasty Briefsbeta