Harvesting SSH Credentials: Insights from my Honeypot Network - Uphill Security
2026-08-02
Harvesting SSH Credentials: Insights from my Honeypot Network
I’ve been working on this honeypot network for the past couple of months, and I’d now like to share some information from the first 30 days.
In this article: :
Intro and short summary
the Data - credentials, attack sources, and so on
the Tech - servers, automation, honeypot
the Future - some plans and next steps
The project is still work-in-progress and I plan to improve it over time. The presentation is still a little bit rough, but this will do for now.
Feedback and questions are welcome!
Intro #
Locations of honeypots
References for this article:<br>- Timeframe = July 2026<br>- 15 servers (only dedicated for this purpose)<br>- 15 IPs, IPv4<br>- all over the world (see above)<br>- 5 VPS Providers<br>- SSH Honeypot, Port 22/TCP
The Data #
Some things to consider before we start:
Most honeypots are currently in Europe (60%) - I plan to add more
Passwords and usernames are percent-encoded (like an URL) to provide the information lossless and fully reversible - use Cyberchef to reverse it.
Only login attempts are considered - scans or other attacks are not (yet)!
I can’t publish the IPs of the attackers as I am not yet familiar with the privacy laws
Presentation is still rough, but will improve with next versions.
Summary
Unique IPs: 6790<br>Total Login Attempts: 1,531,053<br>Unique Credentials: 131922 (Pair UN+PW)<br>Unique Usernames: 12238<br>Unique Passwords: 97621
Attack IP Sources #
Continent
== Continent by unique IPs ==<br>IPs share continents<br>4084 60.1% Asia<br>1294 19.1% Europe<br>832 12.3% North America<br>360 5.3% South America<br>190 2.8% Africa<br>30 0.4% Oceania<br>6790 100.0% 6 distinct continents
== Continent by login attempts ==<br>attempts share continents<br>921439 60.2% Europe<br>453254 29.6% Asia<br>97441 6.4% North America<br>38604 2.5% South America<br>18793 1.2% Africa<br>1522 0.1% Oceania<br>1531053 100.0% 6 distinct continents
== Continent by attempts per IP ==<br>att/IP IPs attempts continents<br>712.1 1294 921439 Europe<br>117.1 832 97441 North America<br>111.0 4084 453254 Asia<br>107.2 360 38604 South America<br>98.9 190 18793 Africa<br>50.7 30 1522 Oceania<br>225.5 6790 1531053 6 distinct continents, average
Country
== Country by unique IPs ==<br>IPs share countries<br>1653 24.3% China<br>721 10.6% United States<br>458 6.7% India<br>338 5.0% Vietnam<br>286 4.2% South Korea<br>276 4.1% Netherlands<br>236 3.5% Hong Kong<br>206 3.0% Germany<br>184 2.7% Brazil<br>182 2.7% Russia<br>178 2.6% Singapore<br>169 2.5% Indonesia<br>162 2.4% France<br>134 2.0% Malaysia<br>123 1.8% Taiwan<br>78 1.1% Japan<br>78 1.1% United Kingdom<br>71 1.0% Sweden<br>55 0.8% Iran<br>53 0.8% Bangladesh<br>1149 16.9% ... 109 more<br>6790 100.0% 129 distinct countries
== Country by login attempts ==<br>attempts share countries<br>686449 44.8% Netherlands<br>112793 7.4% China<br>72314 4.7% United States<br>70413 4.6% Indonesia<br>68810 4.5% Romania<br>46318 3.0% Vietnam<br>44404 2.9% Singapore<br>38194 2.5% India<br>32136 2.1% South Korea<br>31171 2.0% Germany<br>30740 2.0% Hong Kong<br>28103 1.8% France<br>19012 1.2% Mexico<br>17765 1.2% Brazil<br>15047 1.0% Japan<br>14221 0.9% Poland<br>13478 0.9% Finland<br>12366 0.8% Russia<br>12272 0.8% Switzerland<br>12001 0.8% Turkey<br>153046 10.0% ... 109 more<br>1531053 100.0% 129 distinct countries
== Country by attempts per IP ==<br>(74 countries with fewer than 10 IPs excluded)<br>att/IP IPs attempts countries<br>2646.5 26 68810 Romania<br>2487.1 276 686449 Netherlands<br>721.9 17 12272 Switzerland<br>644.2 13 8374 Lithuania<br>446.5 16 7144 Peru<br>421.3 19 8005 Uzbekistan<br>421.2 32 13478 Finland<br>416.6 169 70413 Indonesia<br>414.4 25 10361 Spain<br>374.2 38 14221 Poland<br>372.8 51 19012 Mexico<br>315.7 11 3473 Nigeria<br>300.0 40 12001 Turkey<br>249.5 178 44404 Singapore<br>192.9 78 15047 Japan<br>185.3 53 9820 Bangladesh<br>173.5 162 28103 France<br>151.3 206 31171 Germany<br>150.6 78 11746 United Kingdom<br>139.7 55 7686 Iran<br>84.5 4995 422119 ... 35 more<br>230.1 6538 1504109 55 distinct countries, average
(74 countries with fewer than 10 IPs excluded)
ASN
== ASN by unique IPs ==<br>IPs share ASNs<br>303 4.5% AS8075 Microsoft Corporation<br>280 4.1% AS4134 CHINANET BACKBONE No.31,Jin rong Street<br>259 3.8% AS14061 DigitalOcean, LLC<br>212 3.1% AS4811 Shanghai Telecom Company<br>193 2.8% AS4766 Korea Telecom<br>182 2.7% AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.<br>163 2.4% AS137718 Beijing Volcano Engine Technology Co., Ltd.<br>139 2.0% AS4837 CHINA UNICOM China169 Backbone<br>115 1.7% AS4818 DiGi Telecommunications Sdn Bhd., Digi Internet Exchange<br>110 1.6% AS197170 TechTies Inc.<br>107 1.6% AS16276 OVH SAS<br>105 1.5% AS7552 Viettel Group<br>99 1.5% AS9808 China Mobile<br>92 1.4% AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED<br>84 1.2% AS132203 Shenzhen Tencent Computer Systems Company Limited<br>83 1.2% AS45102 Alibaba US Technology Co., Ltd.<br>73 1.1% AS24086 Viettel Corporation<br>69 1.0% AS37963 Hangzhou Alibaba Advertising Co.,Ltd.<br>61 0.9% AS31898 Oracle Corporation<br>57 0.8% AS17421 Chunghwa Telecom Co., Ltd.<br>4004 59.0% ... 1314 more<br>6790 100.0% 1334 distinct ASNs
== ASN by login attempts...