Malicious actors are sadly everywhere these days so maintaining a good security posture for servers is essential. Last night I was enjoying watching this Mexican IP – 187.205.205.34 (dsl-187-205-205-34-dyn.prod-infinitum.com.mx) “lifting the door handles”.
You’d hardly call three to four attempts per minute a brute force attack. Perhaps it was to keep “off the radar”. Well that didn’t work… The malicious actor made 154 attempts before giving up (including some duplicate username/password pairs).
I’m still trying to figure out what the end game was, unless his collection of usernames and passwords are actually common.
Anyway. Here’s what was tried:
- postmaster / password
- postmaster / P@ssw0rd
- postmaster / 123456
- postmaster / postmaster1
- postmaster / 12345678
- postmaster / 123456789
- postmaster / asdfgh
- postmaster / Postmaster
- postmaster / qwerty
- postmaster / qwerty123
- postmaster / abc123
- postmaster / abc123456
- postmaster / pass123
- postmaster / Postmaster123
- postmaster / 1q2w3e
- postmaster / Postmaster123
- postmaster / POSTMASTER1
- postmaster / 123qwe
- postmaster / Postmaster1
- postmaster / 1q2w3e4r
- postmaster / POSTMASTER
- postmaster / qwertyuiop
- postmaster / POSTMASTER
- admin / password
- admin / P@ssw0rd
- admin / P@ssw0rd
- admin / 123456
- admin / admin
- admin / admin1
- admin / 12345678
- admin / Admin
- admin / asdfgh
- admin / 123456789
- admin / qwerty123
- admin / 654321
- admin / abc123
- admin / abc123456
- admin / Admin123
- admin / ADMIN1
- admin / 1q2w3e
- admin / 1q2w3e4r
- admin / Admin1
- admin / 123qwe
- admin / ADMIN
- admin / qwertyuiop
- test / P@ssw0rd
- test / password
- test / test
- test / test123
- test / test1
- test / 123456
- test / 12345678
- test / asdfgh
- test / qwerty
- test / 654321
- test / qwerty123
- test / abc123
- test / abc123456
- test / Test123
- test / TEST1
- test / 1q2w3e
- test / 1q2w3e4r
- test / 123qwe
- test / Test1
- test / TEST
- test / qwertyuiop
- test / qwertyuiop
- root / password
- root / P@ssw0rd
- root / root
- root / 123456
- root / 12345678
- root / 123456789
- root / asdfgh
- root / Root
- root / qwerty
- root / 654321
- root / pass123
- root / abc123456
- root / 1q2w3e
- root / Root123
- root / ROOT1
- root / ROOT1
- root / ROOT1
- root / 1q2w3e4r
- root / 123qwe
- root / qwertyuiop
- root / ROOT
- backup / password
- backup / backup
- backup / 123456
- backup / backup1
- backup / backup1
- backup / backup1
- backup / backup123
- backup / Backup
- backup / 12345678
- backup / Backup
- backup / asdfgh
- backup / 123456789
- backup / 654321
- backup / qwerty
- backup / qwerty123
- backup / abc123
- backup / pass123
- backup / abc123456
- backup / Backup123
- backup / 1q2w3e
- backup / BACKUP1
- backup / Backup1
- backup / 1q2w3e4r
- backup / 123qwe
- backup / BACKUP
- backup / qwertyuiop
- info / P@ssw0rd
- info / password
- info / info
- info / info1
- info / 123456
- info / info
- info / info123
- info / 12345678
- info / 123456789
- info / asdfgh
- info / qwerty
- info / 654321
- info / qwerty123
- info / abc123
- info / pass123
- info / abc123456
- info / Info123
- info / 1q2w3e4r
- info / INFO1
- info / Info1
- info / INFO
- info / qwertyuiop
- postgres / P@ssw0rd
- postgres / password
- postgres / postgres
- postgres / postgres1
- postgres / postgres123
- postgres / asdfgh
- postgres / Postgres
- postgres / 123456789
- postgres / qwerty123
- postgres / 654321
- postgres / qwerty
- postgres / abc123
- postgres / pass123
- postgres / abc123
- postgres / abc123
- postgres / abc123456
- postgres / Postgres123
- postgres / 1q2w3e