# Dataplane.org - for operators, by operators # sshidpw # 2022-09-20 00:15 - 2022-09-27 00:15 # # The sshidpw report is free for non-commercial use ONLY. If you wish # to discuss commercial use of this service, please contact us at # info@dataplane.org. Redistribution of the sshidpw report in whole or # in part without the express permission of Dataplane.org is expressly # prohibited. # # This report is made possible through the generous support of people # like you. Sensor, processing, and distribution systems require # non-free resources to setup and maintain. We are always looking for # financial contributions to help pay the bills and hosting to increase # visibility. If you find what we do useful, please consider supporting # us. # # This report is informational. This is not a block list. Deriving # malicious or benign intent for an individual entry in the face of # NATs, address spoofing, and certain types of Internet activity # (e.g., surveying research) can be difficult. The report is provided # on an as-is basis with no expressed warranty or guarantee of accuracy. # Use of this data is at your own risk. If you have questions about # this report do not hesitate to contact us. # # Entries below are records of id/password pairs that have been # observed from unsolicited SSH password authentication attempts. # Each entry is sorted by id/password pair in ascending alphabetical # order. Low occurrence pairs and any pair with a NULL value are # excluded from the report. # # The report format is as follows: # # category | id | password # # Each field is described below. Please note any special formatting # rules to aid in processing this file with automated tools and scripts. # Blank lines may be present to improve the visual display of this file. # Lines beginning with a hash ('#') character are comment lines. All # other lines are report entries. Each field is separated by a pipe # symbol ('|') and at least two white space characters on either side. # # category Descriptive tag name for this entry. For this report, # the text sshidpw will appear. # # id An id associated with the succeeding password that has # been observed in unsolicited SSH password authentication # attempts. id string length output is limited to 32 # characters. # # password A password associated with the preceding id that has # been observed in unsolicited SSH password authentication # attempts. # # NOTE: Specific first or last seen time stamps are not provided for the # id/password pairs in this report. This report is a compilation # of id/password pairs seen within the interval shown at the top # of the report. # # NOTE: Special characters and white space may appear in the id and # password field strings. # # A commented footer section shows an aggregate count of id/password # pairs seen in the current report. # sshidpw | ! | root sshidpw | * | root sshidpw | ***** | ***** sshidpw | *- | *- sshidpw | *- | admin sshidpw | *- | root sshidpw | *-+ | root sshidpw | ,. | g sshidpw | ,. | root sshidpw | . | root sshidpw |