Part A counted the readers. This one counts something less flattering: the people trying the door.

Across 264,970 credential attempts against this honeypot, spanning 6,886 distinct usernames, one name arrives in a position nobody would have predicted eighteen months ago.

root leads the corpus at 101,066. admin follows at 34,379. Then ubuntu, user, test, deploy — the fixtures of every wordlist ever written.

And at sixteen, between steam and debian, sits the name of a product.

This is not a campaign

The obvious reading is that someone has decided to hunt AI users. The data says otherwise, and the correction matters more than the headline.

AS197170 — TechTies Inc., Seychelles — contributes 676 of the 1,163 attempts, 58% of everything, from 54 addresses. Look at what else it runs:

root / 123456        89        root / 1234        85
admin / admin        86        root / password    85
root / 12345678      86        root / qwerty      82
root / 12345         86        test / test        79
root / root          86        root / 123456789   86

That is the most commodity dictionary imaginable. claude is one line in it.

Nobody at TechTies sat down and decided to target AI developers. The name was added to a wordlist, and the wordlist runs against everything, forever, because that is what wordlists do.

That is worse, not better. A campaign ends when someone decides to stop. A dictionary entry persists because nobody ever revisits it. oracle has been in these lists for twenty years — not because anyone is hunting Oracle DBAs, but because it got added once and there was never a reason to remove it.

claude has now joined that set. On present evidence it will still be there in a decade.

The escalation changed shape

July alone exceeds March through June combined.

But the ratio is the more revealing number. April and May ran at ~1 attempt per address — a hundred and fifty nodes each trying the name once. That is reconnaissance: is this account worth anything?

June and July run at ~9.4 — a dictionary being walked against a specific account by operators who have concluded the answer is yes.

The passwords tried, in order: claude, claude123, 123456, 1, 12345678, password, 123, 1234, abc123, root. From the Aceville cohort, three targeted variants that no generic list would contain — Claude2026!, claude18, claude22.

The dictionary is maintained

Two details indicate a living artifact rather than independent rediscovery.

Entries are pruned. chatgpt (10 attempts) and copilot (5) both stopped in April 2026. claude and cursor continued through July. Somebody assessed which names were producing and dropped the ones that weren't.

Entries arrive in clusters. Five password variants against claude — 1, password, 123, abc123, root — all first appear on 2026-06-30. Not spread across weeks as separate operators discovered them independently. One date.

That is a revision propagating to subscribers. Which means the composition of these dictionaries is itself a trackable signal — a running poll of which tools attackers currently believe are worth the disk space.

Current standings:

Claude at roughly fourteen times the next name.

Both doors, one prize

Part A documented the web vector hunting the configuration files:

/.claude.json          /.claude/settings.json      /.clauderc
/.anthropic/config.json    /.openai/config.json
/.config/anthropic/credentials/default.json    /.cursor/mcp.json

AS22295 ran the Anthropic and OpenAI paths from a single address seventeen milliseconds apart, across three separate /24s.

This part documents the SSH vector hunting the account.

The precondition is identical. Somewhere there is a developer machine with an account named after the tool it runs, holding an API key with live billing attached. One route finds the key in a file left inside a deployed web root. The other finds the account that owns the file.

Neither requires a novel technique. The only new thing is that the target class is now considered worth a permanent dictionary entry.

What the zero means, and what it does not

No attempt succeeded. Zero of 1,160.

That is a true result and a weak one, and it should not be read as reassurance. This honeypot has no account named claude. The attempts could only ever have failed. The observation measures the absence of the target — not the strength of any control.

It transfers to a real estate as a question rather than a comfort:

Does any host you own have an account named after an AI tool? What is its password? What key does it hold, and what is the monthly ceiling on that key?

Eighteen months ago that question would have been strange. On this evidence it is now worth asking of any developer machine reachable on 22/tcp.

The uncomfortable symmetry

Part A ended on the observation that this corpus is read overwhelmingly by machines — 19,494 agent requests, 918 dossiers served — and that the work travels further than it otherwise would while arriving stripped of its calibration.

This part ends on the other half of the same development.

The tools that read the work are the same tools whose credentials are being hunted. ClaudeBot fetches the dossiers; claude is the sixteenth most-attempted username against the honeypot that produces them. The identity that arrives politely at the front door in the morning is, by evening, a line in a wordlist being tried against the back one.

Neither fact is about Anthropic, or OpenAI, or Cursor. Both are about what happens when a category of software becomes valuable enough to be worth impersonating and worth stealing from — usually in that order, usually within about a year, and usually before the people running it have thought about the account name they chose.