password.leverhet.in

A fake SSH server (a honeypot) sits on the internet and lets bots try to log in. Every username and password they try is recorded. This page shows, live, what they guess most.

–

Last 24 hours

–

Different passwords

–

tried at least once

Different usernames

–

tried at least once

Attacking machines

–

Top passwords

Most tried passwords, with number of attempts

Top usernames

Most tried usernames

Attempts per day

Last 30 days

Show as table

Favourite combinations

Username and password tried together

How long are the passwords?

Attempts by password length (characters)

What are they made of?

Attempts by type of characters used

What does this teach us?

Bots try short, simple passwords first. If yours is on this page, change it today.
A long passphrase of four or more random words is easier to remember and far harder to guess.
Never use the username as password, and never keep a default password like admin or raspberry.
On servers, turn off password login for SSH and use keys instead. This honeypot accepts the guesses on purpose; a real server shouldn't.