I. The Complete Credential Landscape
II. Two Populations โ Two Business Models
๐ญ Industrial Scanners
attempts from 2 credential pairs
- admin/admin: 14,664 (45 att/IP avg)
- admin/123456: 5,623 (62 att/IP avg)
- 3 ASNs = 90% of volume
- Same IPs retry relentlessly
- Target: factory-default devices
- Strategy: hammer the door
๐ฟ Organic/Botnet Scanners
attempts from 8+ credential pairs
- root/root: 298 (1.4 att/IP avg)
- test/test: 97 (1.01 att/IP!)
- root/password: 111 (1.1 att/IP)
- 211+ unique IPs, each tries once
- Target: diverse system types
- Strategy: spray and move
III. The test/test Anomaly โ Perfect Spray Signature
97 attempts from 96 IPs. A ratio of 1.01.
1. C2 server maintains a list of targets (including our honeypot IP)
2. C2 assigns each compromised bot a batch of targets + a credential pair
3. Bot tests the credential once per target
4. Bot reports results back to C2
5. Bot moves to next batch โ never retries the same target
The 1.01 ratio is too perfect to be accidental. It reveals the architecture of the botnet C2: assignment is per-target, not per-session. The bot doesn't decide what to test โ it receives instructions.
IV. The pi/raspberry Market Niche
The pi/raspberry credential pair reveals something unexpected: market specialization.
| ASN | Country | Attempts | Share |
|---|---|---|---|
| AS132649 | ๐ฎ๐ฉ Indonesia | 229 | 54.7% |
| AS213250 | ๐ฉ๐ช Germany | 85 | 20.3% |
| AS213790 | ๐ฑ๐น Lithuania | 22 | 5.3% |
| AS211736 | ๐ณ๐ฑ Netherlands | 20 | 4.8% |
| 37 others | Various | 63 | 15.0% |
Why Raspberry Pis? Because they're everywhere โ homes, schools, small businesses, IoT projects โ and the default credential pi/raspberry was shipped on every unit until 2022. Many users never change it. A compromised Pi provides: a clean residential IP for proxy services, a persistent foothold in home networks, a CPU for cryptocurrency mining, and a node in the next generation of scanning botnets.
This is market segmentation in criminal economies. The generic scanners are Walmart โ high volume, low margin, everything for everyone. The Indonesian Pi specialist is a boutique โ lower volume, specific product, possibly higher margin per unit because IoT access has unique value (residential IP addresses command premium prices).
V. The root/admin Reversal โ Reading Sysadmin Psychology
187 attempts for root/admin. Think about what this targets: a system where someone set root's password to "admin".
The attacker who includes root/admin in their dictionary has studied how humans fail at security. They know that the most common password "rotation" is a lateral move to another default-adjacent string. This is applied behavioral psychology in credential selection.
VI. Information Theory of Credential Selection
Entropy Analysis: How Much Information Is in Each Credential Choice?
In information theory, the entropy of a selection from a set of N equally likely options is logโ(N) bits. The industrial scanners use effectively 2 credential pairs:
- Industrial dictionary size: 2 โ entropy = 1 bit per selection
- Bit 0 = admin/admin (target generic defaults)
- Bit 1 = admin/123456 (target numeric defaults)
The organic scanners use 8+ pairs:
- Organic dictionary size: 8+ โ entropy = 3+ bits per selection
- Each pair encodes a different target class: servers, IoT, cloud, test systems
The industrial scanners have optimized away all entropy โ they've found the two highest-ROI credentials and discarded everything else. Their dictionary is a proof of experience: they've tested thousands of credentials and converged on just two. The organic scanners maintain a broader dictionary because they're fishing in different waters.
VII. The Credential as Market Signal
Returning to the covert communication hypothesis from 051G โ if credential selection encodes information, the two-population model provides the channel capacity:
"If we are to understand where stolen credentials come from, we must consider the different types of credential attacks that exist." Verizon identifies password spraying (low-and-slow across many accounts) vs brute forcing (high-volume against specific targets). Our data perfectly mirrors this taxonomy: organic scanners = password spraying (1 att/IP), industrial scanners = brute forcing (45+ att/IP).
VIII. The Complete Operator Profile
Across letters 051A through 051I, we have now constructed a multi-dimensional profile:
| Dimension | Industrial Operator | Organic Operator |
|---|---|---|
| Schedule | Wednesday, 04:00-06:00 CET | Distributed, no clear pattern |
| Infrastructure | 3 ASNs, dedicated VPS | 211+ IPs, compromised devices |
| Dictionary | 2 pairs (1 bit entropy) | 8+ pairs (3+ bits entropy) |
| Persistence | 45-62 attempts per target | 1 attempt per target |
| Tools | GoSSH (HASSH fingerprint) | Various (no common HASSH) |
| Post-Auth | SSH key deployment, malware | Minimal (fingerprint only) |
| Market Position | Wholesale access producer | Reconnaissance / data collection |
Next: Letter J will complete the extension series by synthesizing the communication, temporal, and credential analyses into a unified model of criminal operational doctrine โ and assess what this doctrine tells us about the future evolution of credential-based attacks.
Two populations: Industrial (20,287 att, 2 creds, 3 ASNs) vs Organic (1,400 att, 8+ creds, 211+ IPs)
Key ratios: Industrial 45-62 att/IP vs Organic 1.01 att/IP = 50x divergence
Credential entropy: Industrial = 1 bit (two pairs) vs Organic = 3+ bits (eight pairs)
The dictionary IS the intelligence. Two credentials are enough.