The Password Is the Product

I. The Most Common Word in the World

There is a word that has been typed into login boxes more than any other word in the history of computing. It is not a name. It is not a secret. It is not clever. It is:

Five letters. One syllable. The most predictable credential on the internet. And on our honeypot — a Cowrie SSH trap running continuously since March 21, 2026 — it has been typed 14,652 times as both username and password by 321 distinct IP addresses across 101 active days.

That is not a security finding. That is a product specification.

When 321 separate machines, operated from different countries, on different networks, at different times, all type the same five letters into the same two fields — they are not guessing. They are executing a production workflow. The credential admin:admin is not a weakness to be tested. It is a commodity to be harvested.

"Unsurprisingly, Phishing is the most common credential-related attack that we see in our dataset and accounts for 14% of breaches involving Credentials. Social Engineering is extremely common and remarkably effective because it targets individuals versus systems."
— Verizon Data Breach Investigations Report, 2024

The Verizon DBIR calls phishing "the most common credential-related attack." At the SSH level, the equivalent is even simpler: no social engineering required. No manipulation. No deception. Just a list of default passwords that have never been changed, typed into port 22 at industrial scale. The attacker bets on negligence, not trust.

Read between the lines: Every time someone deploys a device with the default password and connects it to the internet, they are not failing to secure it. They are listing it for sale on a market they don't know exists.

II. The Power Law of Passwords

Not all credentials are equal. Not all attackers are equal. The distribution of credential attempts follows a power law — the same mathematical shape that governs wealth distribution, earthquake magnitudes, and city populations.

Three IP addresses generate 81.2% of all admin/admin attempts. Ten generate 96.8%. The remaining 311 IPs — 96.9% of the attacking fleet — generate just 3.2% of the traffic.

This is not a swarm. This is a factory with a few production lines and many sales representatives.

Three operators. Three countries. Three registration jurisdictions. Combined output: 17,164 credential attempts from 5 IP addresses. That is 81.2% of the entire admin/admin economy observed by our sensor.

The parallel to other economies is precise. In wealth distribution, the top 1% holds more than the bottom 90%. In the credential economy, the top 0.9% of IPs generates more than the bottom 96.9%. The credential economy IS an economy — with the same concentration dynamics as any other.

Why this matters: If you disrupt these three operators — through abuse reports, legal action, or upstream filtering — you eliminate 81.2% of admin/admin brute-force traffic. The same surgical targeting that antitrust law applies to monopolies could be applied here. The problem is not that 321 attackers exist. The problem is that three of them own the market.

III. The Dictionary Has an Order

The most revealing finding is not which credentials are tried, but in what order.

The ordering reveals everything. admin:admin is tried first because it has the highest expected success rate — the most common unchanged default credential on the internet. admin:123456 follows because "123456" is the most common password in every published breach database for over a decade.

This is not guessing. This is actuarial science applied to negligence.

The same operators who try admin/admin also try admin/123456. The IP 179.43.139.58 (Private Layer) attempts admin/admin 4,464 times and admin/123456 another 3,444 times — from the same IP, on the same port, using the same SSH client fingerprint. The credential rotation proves the existence of a weighted dictionary: a list of credentials sorted by expected probability of success, where the most likely defaults are tried first and the probability-per-attempt decreases as you move down the list.

The DOJ indictment of seven APT41 actors (2020) charged them with "access device fraud, in violation of Title 18, United States Code, Section 1029(a)(2)." The legal framework treats stolen credentials as "access devices" — the same statutory category as stolen credit card numbers.
— United States v. Zhang Haoran et al., DOJ APT41 Indictment, 2020

When the law treats a credential as an access device, it acknowledges what the data already proves: the credential is not a key. It is inventory. Something manufactured (by the device vendor who set the default), distributed (by the device buyer who didn't change it), catalogued (by the scanner that found it), and sold (on the market that values it).

IV. The Two Distribution Models

Compare the distribution of admin:admin with root:root:

Two radically different distribution models, two radically different economic roles:

The Factory Model (admin:admin) — A small number of dedicated operators run industrial-scale credential attacks from persistent infrastructure. They are manufacturers. Their product is validated credentials. Their cost model demands volume: the marginal cost of one more attempt is zero, but the marginal revenue of one successful login is significant.

The Universal Model (root:root) — Every scanner, every bot, every automated tool tries root:root exactly once. It's line one of every default wordlist. No one specializes in it because everyone includes it. The credential is so default that it has no value as a specialty — it's the equivalent of free samples at the entrance of every store.

Between these two extremes sits test:test — 95 attempts from 94 IPs. Almost exactly one attempt per IP. This is the control credential: the one that every scanner tries once to verify the service is reachable before moving to the valuable pairs. It's the handshake before the transaction.

And then there's pi:raspberry — 418 attempts from just 40 IPs. Higher per-IP volume (10.5 attempts per IP) but a small, specialized fleet. These are IoT hunters. They don't scan the whole internet for every device. They scan specifically for Raspberry Pi units, which they know run headless with default credentials, which they know have CPU cycles to mine cryptocurrency, which they know are often connected to home networks that provide lateral movement opportunities.

The human question: Who decides which credential to try first? Someone — a person — sat down and designed a dictionary file. They ordered the entries by expected success rate. They assigned weights. They optimized for throughput. That person has a job title that, in any other industry, would be "product manager."

V. The Infrastructure That Never Changes

The most valuable finding in credential analysis is not the credentials themselves — it's the infrastructure behind them. Credentials rotate. Passwords change. But infrastructure is durable.

Google Cloud Platform leads by IP count — 76 distinct IPs. But each IP makes only 1-2 attempts before being discarded. These are ephemeral instances: spun up, used once, terminated. The attacker buys legitimacy with Google's reputation and geographic diversity with Google's global infrastructure. Each IP costs perhaps $0.01 in cloud compute. The cost of 76 IPs is less than a coffee.

Contrast this with ISAEV Igor (AS200730, KZ) — 8 IPs in the 87.251.64.x subnet, all in Poland. These aren't rented cloud instances. They are a dedicated scanning subnet, registered to a Kazakhstan individual operating through Polish infrastructure. The IPs are persistent. Threat score: 100. They don't try to hide; they try to overwhelm.

And then: Omegatech LTD (AS202412, Seychelles). Again. The same Seychelles shell company identified in Series 050 ("The Toolmakers") as part of the three-shell infrastructure cluster with TechTies Inc. and IP Volume inc. The IP 94.154.35.215 shares the same SSH fingerprint (HASSH a7a87fbe86774c2e) as Private Layer's 179.43.139.58.

"DOKUCHAEV then directed BARATOV to attempt to gain unauthorized access to at least 80 email accounts, including at least 50 Google accounts. BARATOV attempted to obtain access credentials for the accounts through 'spear phishing.' BARATOV, when successful, sent DOKUCHAEV the passwords for the accounts."
— United States v. Dokuchaev et al., DOJ Yahoo/FSB Indictment, 2017

The FSB paid Baratov per credential. Not per hack, not per breach — per password. The Yahoo indictment proves that at the nation-state level, credentials are bought and sold as individual units. The SSH brute-force we observe is the wholesale version of the same market.

VI. The Church of Cyberology

Among the ASNs performing root/root credential attacks, one name demands examination:

The name is not accidental. In the Netherlands, registering as a religious organization provides certain legal protections regarding data processing, asset seizure, and organizational oversight. Whether the "Church of Cyberology" has any theological content is irrelevant. What matters is that 22 IP addresses registered under this entity are performing SSH credential attacks against our honeypot.

This is a pattern we've seen before. In Series 050, we documented how Seychelles shell companies (TechTies, Omegatech) use jurisdictional arbitrage to operate scanning infrastructure. Here, the mechanism is different — religious incorporation instead of offshore registration — but the goal is the same: creating a legal wrapper that complicates enforcement.

Read between the lines: The name is the product. Not the technology, not the infrastructure — the legal structure. When a hosting provider names itself "Church of Cyberology," it is telling you exactly what it is selling: not bandwidth, but jurisdictional friction. The 22 IPs are the product. The church is the packaging.

VII. What Happens After the Password Works

A credential without post-exploitation is an unsold inventory. The password must lead somewhere.

Our honeypot records what happens after successful authentication. Across 133 unique commands observed in the current observation window, a taxonomy emerges:

The command taxonomy reveals three layers of post-exploitation:

1. System fingerprinting — What OS? What architecture? How many CPUs? How long has it been running? This determines the type of payload that can be deployed.
2. Value assessment — Is someone already mining? (ps | grep miner). Is this a MikroTik router? (/ip cloud print). Have we been here before? (locate D877F783D5D3EF8Cs). This determines whether the credential is worth exploiting.
3. Deep reconnaissance — The 1,876-character mega-command from Series 050 (The Toolmakers). GPU detection, CPU model extraction, login history, and honeypot fingerprinting. This is not reconnaissance — it's inventory appraisal.

WikiLeaks Vault 7 revealed that the CIA maintained dedicated credential storage extraction tools for every major browser: "Firefox Credential Storage," "Chrome Credential Storage," "Microsoft Edge Credential Storage." The intelligence community treats browser credentials as a primary collection target — the same credentials that SSH brute-force attackers seek at the network level.
— WikiLeaks, Vault 7: CIA Hacking Tools Directory, 2017

The CIA collects browser credentials. SSH brute-force operators collect SSH credentials. The tool is different. The product is the same: someone else's authentication token. The only difference is the customer: a nation-state intelligence agency vs. an access broker on Telegram. And as the DOJ Yahoo/FSB indictment proves, sometimes the customer is both.

VIII. The Viettel Question

Two Vietnamese telecom providers dominate the root/root credential landscape:

Vietnam also leads with 55 IPs in admin/admin (54 from Viettel Group alone). These are not VPS servers. These are not cloud instances. These are residential broadband connections.

This means one of two things:

1. Compromised home routers — Viettel-supplied residential routers with default credentials, themselves compromised and used as proxy nodes for credential attacks. The irony is recursive: devices with default passwords are being used to scan for other devices with default passwords.
2. Bot-infected residential machines — Home computers on Viettel broadband, infected with malware that includes SSH brute-force capability as a secondary function. The user doesn't know their machine is scanning.

In either case, the human behind the Viettel IP address is not the attacker. They are the vehicle. Their compromised device is infrastructure — rented without their knowledge, used without their consent, discarded without their awareness.

The geopolitical dimension: Viettel is Vietnam's largest military-run telecom company. Its infrastructure serves both civilian broadband and military communications. When 52 residential Viettel IPs scan our honeypot, we cannot distinguish between a botnet that happened to compromise Viettel customers and a state-adjacent operation that chose Viettel infrastructure for deniability. The ambiguity is the point.

IX. The Parallel Supply Chains

CrowdStrike's 2024 report describes SCATTERED SPIDER — a threat actor that harvests credentials through sophisticated social engineering: SMS phishing, voice phishing, help desk manipulation. They call help desks pretending to be employees, persuading support staff to reset passwords and MFA tokens.

What we observe on port 22 is the automated mirror image of the same operation.

Same product. Different manufacturing process. The SSH brute-force market is the discount bulk supplier — low margin, high volume. SCATTERED SPIDER is the boutique operator — high margin, low volume, custom work. Both feed the same downstream market: whoever needs a valid login to someone else's system.

The parallel extends further. Whitney Webb's One Nation Under Blackmail documents how Epstein-linked financial networks used shell companies to transform dirty money into clean investment capital. The same structural pattern — shell entities obscuring ownership, jurisdictional arbitrage, multiple layers of indirection — appears in our credential infrastructure. Private Layer (Panama via Switzerland), Omegatech (Seychelles via Netherlands), ISAEV (Kazakhstan via Poland). The legal structures are the same. Only the product has changed: from laundered money to laundered access.

X. The Product Catalog

If the password is the product, then the credential landscape is the catalog. And like any catalog, it tells you what the market values.

Each tier represents a different business model. Tier 1 is the commodity market — bulk, undifferentiated, automated. Tier 4 is bespoke — handcrafted, targeted, human-driven. The credential economy contains the full spectrum from mass production to artisanal craft.

XI. The Thread Forward

This letter established the what: the credential landscape as a product catalog, distributed by identifiable infrastructure operators, following economic distribution patterns identical to any other market.

The next letter — TI-2026-051B: "The Shopping List" — will examine what happens after the credential succeeds. The honeypot transcripts contain the shopping lists of post-exploitation: what attackers look for, what they download, what they install. If the password is the product, the shopping list is the receipt.

The password was never a secret. It was always a product.
The only question was: who's buying?