The Open Armory — The Password List Is Public, and We Have It Too

TI-2026-069A · Series: 🧰 The Open Armory · TLP:WHITE · 2026-07-09

The credential attack that hits every SSH server on earth runs on a weapon anyone can download. It's a GitHub repo. It's in our own library. And the honeypot proves they fire it verbatim.

📋 The Short Version

There is a comforting myth that attackers know secret passwords — some private list of the credentials most likely to work. They don't. They run SecLists: a public, curated, versioned GitHub repository of wordlists that sits, mirrored, inside our own OSINT library as 996 documents.

We can open the exact file the attacker is about to fire. And when we compare it to what the honeypot actually caught — 161,181 credential attempts across 33,893 distinct pairs — the head of the distribution is that file: admin:admin, admin:123456, pi:raspberry, root:toor, support:support, test:test. The public dictionary, fired back at us, one login at a time.

Three details make it sharper: they fire large lists (not lucky guesses), they pick the list to match the protocol, and the list is alive — it has already absorbed claude as a username.

Confidence: HIGH on the honeypot attempts and the library holdings. MEDIUM that any single attack pulled specifically from SecLists rather than one of its public siblings — they are interchangeable.

1. The Armory Is on Our Own Shelf

Open seclists-0765.txt in the library — Passwords/Default-Credentials/cryptominers.txt:

# Most common default passwords on ASIC mining devices (HTTP, SSH, telnet...)
root:root
admin:admin
root:blacksheepwall
root:innot1t2
root:t1t2t3a5

Next to it: Citrix defaults (nsroot), DB2 defaults, password-permutations.txt (password, P4ssword, passw0rd, p455w0rd…), keyboard-walk lists. This is not leaked intelligence. It is a maintained open-source project, and we hold all 996 documents of it precisely because the attackers do too. The armory is not hidden. It is catalogued.

2. The Honeypot Fires It Back, Verbatim

Here is what actually arrived. The top of 161,181 attempts:

Every single one is a canonical public-wordlist entry. There is no bespoke intelligence here — no password the attacker "figured out." There is a repository, and there is a loop that reads it.

3. They Fire the Whole Book, Not a Page

This is not a handful of educated guesses. The top 100 pairs cover only 35% of all attempts. The other 65% is a long tail spread across 33,893 distinct pairs — the mechanical signature of tooling running a large wordlist end to end.

That shape matters for defense. A human types three likely passwords and gives up. A tool reading SecLists traverses tens of thousands. The distribution of the attempt itself identifies the weapon — full-dictionary traversal against a live service is presumptively hostile, and you can recognize it from the shape alone, before a single guess succeeds.

4. The List Is Chosen to Fit the Lock

A subtle tell: the famous Mirai IoT/telnet default credentials are almost absent here. xc3511 — 9 attempts. vizxv — 8. 7ujMko0admin — 3. blacksheepwall, innot1t2 — zero.

Those creds devastate telnet-exposed IoT devices. Against our SSH sensor they barely register, because the attackers fire the list that matches the protocol. They know they hit SSH, so they load the SSH-and-server wordlists, not the IoT-telnet ones. The choice of dictionary is not random — it is a small act of targeting, and it tells you what the attacker believes they are looking at.

5. The Armory Is Alive — It Learned the Word "Claude"

The single most modern thing in the data: the username claude drew 563 attempts from 313 distinct IPs.

claude is not in a classic 2015-era default-credential file. It is there because the commodity dictionary is a living, crowd-extended artifact — attackers add new service identities as those services become worth attacking, and they do it fast. AI infrastructure did not get a grace period. The moment it was worth a login attempt, the public armory absorbed it, and every operator running the shared list inherited the new target for free.

Defenders of AI services should read this plainly: you inherit the entire pre-existing credential-attack economy on day one. There is no new-service honeymoon.

6. Why This Matters — and the Honest Limit

For defense. The enemy's dictionary is not merely knowable; it is downloadable. You can pre-load the exact list the attacker will fire and treat any full-traversal of it as an alarm. The behavior — reading a public wordlist against a stranger's login — is the signal, and it is machine-obvious.

The honest limit. SecLists is dual-use, and that is not a caveat to bury. Red teams, auditors, and defenders use it every day; it exists to make systems stronger. A credential appearing in it means nothing about intent. What is hostile is not the ammunition but the act: firing 33,893 distinct pairs from a public list at someone else's production SSH. The wordlist is neutral. Aiming it at a stranger is not.

This is the same doctrine the rest of the corpus keeps arriving at from other directions: judge the behavior, not the artifact. The Open Armory series will now walk the rest of the shelf the same way — the scan templates (Nuclei), the exploit proofs (Exploit-DB), the CVE catalog — each a public tool we can read before we watch it used.

Investigation Metadata

Cross-references: TI-2026-051I (The Dictionary — what credential selection reveals) · TI-2026-019F (Ghost in the Machine — the 'claude' username hunt) · TI-2026-068D (The Same Hand — judge the behavior, not the artifact) · TI-2026-051A (The Password Is the Product).