moltenbit//20240716
top tested usernames and passwords on my #honeypot in the last 24 hours
Gottfried Szing@moltenbit ah yes, the user 345gs5662d34! nice to see him again. maybe you can send him greetings from 548go92fck325? 😆
just kidding but who tests for a user 345gs5662d34? 🤷♂️
@kjoo i could send you the IPs if you're really interested.
there's an interesting thread on it here https://notpickard.com/@rdp/111009868239846779
-> possibly something like a tracker introduced by botnet masters to see how their activity is followed
also, maybe it's something like a honeypot test; if this combination works, then there's a 99,999% chance it's a honeypot with any/any credentials allowed
robert daniel pickard (@[email protected])
@[email protected] could 345gs5662d34 be something like a 'radioactive dye’ to see how how a botmaster's network is being see from open security honeypots? like the string is random enough that it's easy to identify in published data sets and feeds so someone running a bot network could get a sense of how their activity is being tracked? i can't tell the difference in a dataset between my “root:root" attempt and someone else’s, but it's likely I’m the only one trying “345gs5662d34: 345gs5662d34”