Mirai Botnet User: Pass Tracking

Below is a basic CSV of the number attempts from the Mirai BotNet to one of my VPS servers. The list of User and Passwords came directly from the Mirai source code on GitHub and is listed in the same order as the source code. Some interesting observations:

  1. The number of attempts very closely correlates to the order in which usernames and passwords are listed in the source code
  2. Adminstrator:admin had no attempts
  3. guest:guest had no attempts
  4. guest:12345 is listed twice in the source code


User Pass Number of Attempts
root xc3511 246
root vizxv 234
root admin 215
admin admin 186
root 888888 116
root xmhdipc 100
root default 105
root juantech 103
root 123456 90
root 54321 110
support support 94
root (none)
admin password 116
root root 146
root 12345 120
user user 64
admin (none)
root pass 67
admin admin1234 67
root 1111 68
admin smcadmin 43
admin 1111 38
root 666666 44
root password 46
root 1234 41
root klv123 63
Administrator admin
service service 19
supervisor supervisor 20
guest guest
guest 12345 38
guest 12345 38
admin1 password 23
administrator 1234 16
666666 666666 19
888888 888888 21
ubnt ubnt 26
root klv1234 25
root Zte521 54
root hi3518 24
root jvbzd 24
root anko 95
root zlxx. 19
root 7ujMko0vizxv 22
root 7ujMko0admin 22
root system 24
root ikwb 22
root dreambox 28
root user 22
root realtek 16
root 0 26
admin 1111111 21
admin 1234 19
admin 12345 24
admin 54321 17
admin 123456 22
admin 7ujMko0admin 15
admin 1234 19
admin pass 24
admin meinsm 18
tech tech 14
mother fucker 6
%d bloggers like this: