• SSH Exploit: Common Accounts

    From alla3002070@gmail.com@21:1/5 to All on Wed Oct 4 18:57:25 2017
    marți, 11 aprilie 2006, 09:29:49 UTC+4, Mungo a scris:
    Think that the shh crackers only go after simple common account names?
    Think again. Here is a list of the account names used in 85% of crack tries we saw over the last two weeks. "root" and "admin" together accounted for 25%.

    1 2005 20admin 20info 20jobs 20mail 2qjj4toi
    a a2 abramenko academy accept adam adine
    admin administrator Administrator aiaetn aleksandrova
    alekseeva alex alias andrea andres andrew
    andrianov antonov apryatin arapova art
    asen author b backup backups c calendar
    captain captn compile cross cyrus d
    delta directory distributions dmoran e eff
    eike ejohns elena elf elfi eliane ervers-mail
    executables f fax fluffy ftp g glloyd guest hacker hacker2k i ibm imation imbroglio jack james jjmul jmarsden khans
    leo logged marvin max mule mvlahos mysql nobody office olga oracle patrick
    pgsql poq postgres providerprof publicidad qwerty recruit root sales samba scanner
    security settings slackware staff stu
    student student1 student2 student3 student4
    test tester testing testuser thisisnotyourexploit
    tomcat trial upload uploader user webmaster
    zeppelin

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Joe Beanfish@21:1/5 to All on Thu Oct 5 13:39:35 2017
    On Wed, 04 Oct 2017 18:57:25 -0700, alla3002070 wrote:
    marți, 11 aprilie 2006, 09:29:49 UTC+4, Mungo a scris:
    Think that the shh crackers only go after simple common account names?
    Think again. Here is a list of the account names used in 85% of crack tries >> we saw over the last two weeks. "root" and "admin" together accounted for
    25%.

    1 2005 20admin 20info 20jobs 20mail 2qjj4toi
    a a2 abramenko academy accept adam adine
    admin administrator Administrator aiaetn aleksandrova
    alekseeva alex alias andrea andres andrew
    andrianov antonov apryatin arapova art
    asen author b backup backups c calendar
    captain captn compile cross cyrus d
    delta directory distributions dmoran e eff
    eike ejohns elena elf elfi eliane ervers-mail
    executables f fax fluffy ftp g glloyd >> guest hacker hacker2k i ibm imation
    imbroglio jack james jjmul jmarsden khans
    leo logged marvin max mule mvlahos >> mysql nobody office olga oracle patrick
    pgsql poq postgres providerprof publicidad
    qwerty recruit root sales samba scanner
    security settings slackware staff stu
    student student1 student2 student3 student4
    test tester testing testuser thisisnotyourexploit
    tomcat trial upload uploader user webmaster
    zeppelin

    These are the ones I saw most frequently before I went to IP whitelisting:

    a
    admin
    administrator
    administraator
    bergetg
    bigsky
    blank
    cisco
    comcast
    default
    D-Link
    Fake
    fax
    fld
    fluffy
    git
    guest
    iclock
    info
    invalid
    manager
    oracle
    pi
    PlcmSpIp
    postgres
    public
    smtp
    somesecguy
    sql
    support
    tech
    tecmint
    test
    ubnt
    ubuntu
    username
    vagrant
    vyatta

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)