Who is actually knocking
I put a fake corporate file server on the open internet for two weeks and read every credential that was tried against it. The attackers were not after my files.
Summary
The sensor is OpenCanary on a dedicated box, dressed as an internal server: hostname FILESRV01, a Samba finance share with a decoy payroll workbook, and nine services answering at once — SMB, RDP, SSH, Telnet, FTP, HTTP, MySQL, MSSQL and Redis. Every probe streams into a single timeline with the usernames, passwords and commands attempted.
The volume is unremarkable; any exposed host sees this. The interesting part is the 469 distinct credential pairs, because credentials reveal intent in a way packet counts never do.
1 · Where they knocked
| Service | Incidents |
|---|---|
| RDP | 3,409 |
| Telnet | 1,519 |
| SSH | 1,554 |
| HTTP | 531 |
| VNC | 275 |
| MySQL | 228 |
| Redis | 162 |
| SMB | 147 |
| FTP | 50 |
Incidents, not raw probes — repeat attempts from one source against one service are collapsed into a single incident with a hit count, so one brute-force run appears once rather than twenty thousand times.
2 · What they typed
Usernames are predictable: root (898), admin (550), Administrator, default, anonymous, sa, guest.
The passwords are where it gets interesting. They start where you would expect —
| Password | Attempts | What it opens |
|---|---|---|
admin | 315 | everything, eventually |
default | 92 | — |
password | 37 | — |
12345 / 123456 / 1234 | 82 | — |
— and then turn into a hardware catalogue:
| Password | Attempts | What it actually unlocks |
|---|---|---|
zlxx. | 24 | string associated with Mirai-family IoT malware |
Zte521 | 20 | ZTE router default |
Pon521 | 20 | GPON / fiber ONT default |
vizxv | 18 | Dahua / Xiongmai DVR and IP-camera default |
/*6.=_ja | 18 | embedded-device vendor default |
tsgoingon | 17 | embedded-device vendor default |
Nobody was guessing what a finance server's password might be. They were spraying router, fiber-modem, DVR and camera defaults at every open port, hoping whatever answered was a device they could conscript.
The crowd hammering my fake company server was overwhelmingly IoT-botnet recruitment. It was not targeting me. It was not targeting a company at all. It was looking for hardware.
3 · Why this matters for how you read your own logs
If you run anything internet-facing, a large share of what fills your alert queue is this: undifferentiated botnet recruitment that would behave identically against any address. It is not reconnaissance against you. Treating it as though it were is how teams end up drowning.
The credentials are the cheapest available discriminator. A source trying Zte521 is not interested in your file server. A source trying your actual naming convention is a different conversation entirely. That distinction costs nothing to compute and it is not in most triage pipelines.
This is also the argument for capturing what was attempted rather than only that something was attempted. A blocked-login count tells you volume. The password tells you who they thought they were talking to.
Honest limits
One sensor, one fortnight, one IP. The mix will differ by address space, geography and hosting provider. The phenomenon generalises; the proportions should not be quoted as universal.
Attribution of a password to a device family is inference. Zte521, vizxv and the rest are widely documented vendor defaults, but a password appearing in a spray list does not prove the operator's intent — only that the list was built from embedded-device defaults.
None of this is AI. This is commodity automated scanning, and I make no claim otherwise. It is included here as the baseline that makes the interesting traffic legible by contrast.
Incident counts are post-deduplication. Raw probe volume is 717,580; incidents are 7,899. Both numbers are given so neither is misleading on its own.
Reproducing this
OpenCanary is free and open source. The whole sensor is a small VPS and a config file; the deployment notes, including the Samba audit wiring that is the only fiddly part, are in the project repository. Nothing here required a commercial product.