A password is a fingerprint: what the internet's brute force is really typing

§ 01. The keyhole problem

There is a whole genre of honeypot write-up, and it is a good genre. You stand up an SSH honeypot, log every username and password the internet throws at it, and after a month you have a beautiful table: root on top, 123456 the favourite password, a long tail of admin and ubuntu and password. It is honest, useful work, and the recent Uphill Security report – 15 servers, 1.53 million SSH attempts – is a clean example of it. We are building on that genre, not against it.

The limit is the keyhole. Watch port 22 and you learn what people guess at SSH, which is not the same as what the internet is guessing. Mirage presents the services an ordinary organisation exposes – SSH, but also Telnet, RDP, VNC, SMB, SIP, and a rack of databases – and speaks enough of each protocol to capture the credential, not just the connection. Over 44 days that drew 81,065 distinct source addresses and produced 12.2 million login attempts. Sorted by protocol, the "brute-force problem" stops being one problem:

§ 02. Telnet is the loudest door

Telnet outdrew SSH by 40%, and its dictionary is nothing like SSH's. Where SSH guesses root/123456, Telnet arrives with the factory-default credentials of specific hardware – and the credential names the device. These are the exact strings burned into IP-camera, fibre-modem and router firmware, the same lists Mirai and its descendants have carried since 2016. Below is a deep-capture window (48 hours, exact counts) of the top Telnet pairs:

Look at the source-IP column. root:hi3518 comes from 18 addresses; admin:stdONUi0i from exactly one. This is not a crowd guessing – it is a handful of scanners each running one hard-coded list against one device class. Elsewhere in the same window we logged telecomadmin (the Huawei ONT super-user, 14 IPs), zhongxing (ZTE, formerly Zhongxing Telecom), oltuser (fibre Optical Line Terminal) and telnetadmin – an entire supply chain of ISP customer-premises equipment, addressed by name. The attackers are not hoping. They already know what they are looking at.

§ 03. What SSH is actually hunting

SSH is where the "servers" story lives, and it is only half true. The top SSH username is still root (9,484 attempts in the deep-capture window). But the second thing attackers want is not a shell – it is a wallet:

The Solana cluster is the quiet surprise. Combined, solana, sol and solv were guessed more often than admin – and the paired passwords (solana:1234, sol:sol, solv:123456) show the intent plainly: find a box that runs a Solana validator or RPC node, because a validator with a hot wallet is worth more than a shell. This is credential-guessing that has read the market. A single-protocol honeypot sees solana as just another username in the tail; against the whole fleet it resolves into a distinct, financially-motivated campaign.

§ 04. The ghost in every scanner

That 345gs5662d34 in the SSH table is not a typo, and it is the single most useful teaching example in this dataset. It is the factory Telnet/SSH password of the Polycom CX600 IP desk phone – documented for years by SANS ISC and academic honeypot research – and it has escaped into the water supply. It now appears, as both username and password, in a large share of all SSH brute-force worldwide, sprayed by scanners whose authors almost certainly no longer know why it is on the list. We saw the exact pair 345gs5662d34:345gs5662d34 from 305 distinct IPs, and its close variant root:3245gs5662d34 from 125 more.

§ 05. We keep the hashes

Here the medium-interaction fleet does something a log-only SSH honeypot cannot. On protocols with challenge-response authentication, we complete enough of the handshake to walk away with crackable material – not a record that someone guessed a password, but the cryptographic proof of the password itself.

SMB is the clearest case. Present a fake Windows file service and attackers authenticate against it with NTLM; we answer with a fixed server challenge and capture the full NetNTLMv2 response – 674,025 of them from 563 addresses in 44 days. Each one is a Hashcat mode-5600 hash, ready to crack offline:

# Captured from an SMB session-setup, server-side. Truncated; identifiers changed.
USER::WORKGROUP:1122334455667788:80faa9f5397204f6a51fb0ca28ee511d:0101000000000000...
#            ^ fixed honeypot challenge   ^ NTProofStr              ^ blob
# hashcat -m 5600  (NetNTLMv2)

MySQL leaks in a different shape. Its native handshake sends the username in the clear and the password as a SHA-1 "scramble" over the server's nonce – so we log the account and the offline-attackable scramble together:

{ "username": "root",
  "auth_scramble_sha1": "a88cc185bbc93963cdf5bb17174af179d6ad9f47",
  "client_capabilities": "0xbea285", "charset": 45 }

The point is not that we crack them – we do not need to. It is that a credential campaign leaves more evidence on a protocol-aware sensor than on a log tailer, and that evidence (which accounts, which wordlists, which crackers) is what turns a pile of failed logins into attribution.

§ 06. Specialists, on rented infrastructure

Two structural facts close the picture. First, these campaigns do not overlap. Of the addresses that tried any credential in the deep-capture window, 2,114 touched exactly one protocol and only 11 touched two or more. The Telnet camera-hunters do not also brute-force SSH; the MSSQL sa sprayers do not also try VNC. "Brute force" is not a generalist activity – it is many narrow tools, each pointed at one target class.

Second, for all that the credentials target cheap IoT, the attackers run on professional infrastructure. Geolocating the heaviest 300 source addresses, 69% sat in datacentres, not on hijacked home routers – led by a single bulletproof-hosted address (AS AMARUTU-TECHNOLOGY) that alone produced 2.67 million events. The rest is a familiar roll-call of abuse-tolerant hosting:

That TECHTIES-AS line is worth a moment: it is the same ASN (AS197170) that the SSH-only Uphill report independently ranked as its single largest source. Two unrelated honeypot networks, different protocols, same rented infrastructure surfacing at the top – which is exactly the corroboration that turns an observation into intelligence.

§ 07. What to do with this

The defensive reading is sharper than "use strong passwords."

• Telnet is still the emergency. The largest credential campaign on the internet is device-default spraying against CPE and cameras. If anything you own answers on 23/tcp, it will be found and it will be logged in with a password printed in its own manual. Disable it; if you cannot, change the default, because the default is the dictionary.
• Assume SMB exposure means hash theft, not just guessing. Any internet-facing SMB service can be made to hand a NetNTLMv2 hash to whoever asks. Keep 445/tcp off the public internet and disable NTLM where you can.
• If you run crypto nodes, you are a named target. solana/sol/solv are being guessed more than admin. Validator and RPC hosts need key-only SSH and no wallet on a login-reachable box.
• Read a credential list as a fingerprint. The password an attacker sends tells you which device they think they hit. That is a detection primitive: hi3518 on your SSH logs is a mis-aimed camera scanner; 345gs5662d34 is a decade-old ghost; solana is someone hunting money.

This is the second in a monthly series. Mirage – recently launched by OffSeq – turns a distributed, protocol-aware honeypot fleet into live threat intelligence: not "10 million attacks" but which campaign, on which protocol, with which dictionary, from which infrastructure. The same fleet can be deployed inside your own environment, so the credentials and campaigns you see are the ones actually aimed at you – not the internet's weather.

We publish a new field report every month. Follow OffSeq to get each one as it lands.