Two Words

The most-guessed credential on the internet, used two completely different ways

TI-2026-103E · Series: The Loud Hour · Letter E of 15 Operates under the rules of evidence in Letter O — The Instrument. Per R13 (Letter D), credential attempts are read from the credentials record, never from session rows.

Updated 2026-07-30. The full fleet wordlist, listed here as unrecoverable without per-address enumeration, was recovered in Letter H by querying the fingerprint instead. A second correction affects §5. Original text unaltered.

1. What this letter is for

Letter B established that five machines hold 72.2% of every successful login this sensor has granted, using only two credentials and never expanding to a third. It argued that their success survives the sensor's selective-authentication regime and is therefore a property of the credential rather than of the configuration.

That argument was correct as far as it went. This letter takes it further and finds that it was carried one step too far — a claim in Letter B is corrected here in §5.

The subject is the two words themselves: admin/admin and admin/123456. What this letter finds is that the same credential pair is used in two entirely different ways by two populations that share nothing except the string, and that the ratio between attempts and addresses separates them more cleanly than any other signal in the corpus.

2. The corpus of credentials

[DOCUMENTED] The record holds 52,787 distinct username/password pairs. The ten most attempted:

Two things stand out before any analysis.

The most-attempted credential in the entire corpus has never once worked. root with an empty password: 24,899 attempts, 723 distinct addresses, zero successes, sustained from 2026-03-21 to 2026-07-29.

[INFERRED — confidence HIGH] This is almost certainly not a credential attempt at all. SSH permits a none authentication request, and the standard way to enumerate which methods a server will accept is to offer none and read the failure response. A username with an empty password recorded 24,899 times across 723 unrelated hosts, never succeeding, is auth-method enumeration being logged as a credential attempt. admin with an empty password (389 attempts, 13 addresses, zero successes) is the same behaviour with a different username.

[DOCUMENTED] Excluding those two rows, the single largest genuine credential in the corpus is admin/admin, and it succeeds every single time — 16,500 attempts, 16,500 successes, across 534 addresses, 152 autonomous systems, 46 countries and 132 active days.

The sensor's accept rule is broad but not uniform

[DOCUMENTED] Among the top thirty credentials, the split between those that always succeed and those that never do is not obviously patterned:

[DOCUMENTED] admin/password opens the door while admin/admin123 does not. root/1234 works while admin/1234 does not. root/123 works while root/123123 does not.

[INFERRED — confidence HIGH] This is an explicit credential list, not a rule. A honeypot that accepted anything would show 100% everywhere; one with a pattern (say, any password under six characters) would not admit root/password while refusing root/111111. The accept set was enumerated by hand, and Letter O's warning applies with force: the twenty successes per job documented in Letter D are twenty entries of this list, not twenty vulnerabilities.

[DOCUMENTED] One entry deserves separate note. claude/claude — 203 attempts from 168 distinct addresses, zero successes, first seen 2026-03-25. A hundred and sixty-eight unrelated machines have tried a product name as a system account. Commodity wordlists are being refreshed with the vocabulary of the moment, and that is a dateable fact about the tooling rather than about any target.

3. Two populations, one string

[DOCUMENTED] The 16,500 admin/admin attempts are not distributed across 534 addresses in anything resembling an even spread.

[DOCUMENTED] Ten machines account for 94.64% of every attempt. The other 524 average fewer than two attempts each.

The ten:

[DOCUMENTED] Letter B named five beacons. This credential alone identifies ten machines with more than a hundred attempts each, five of which Letter B did not list. Two are same-ASN siblings of named beacons (179.43.133.154 on Private Layer, 185.246.130.20 on w1n); one is a sibling on Omegatech (178.16.54.226, already used as the control in the fleet test); and two are new operators entirely — ZORNTECH WEB SOLUTIONS (AS154383) and Proton66 OOO (AS198953).

[DOCUMENTED] 176.53.159.196 was last seen 2026-07-30T11:58:49Z — the most recent admin/admin attempt in the entire record. It is active now.

Letter B stated that its five-machine beacon census was a lower bound. It was, and this is the correction: the beacon population is at least ten, and the true figure is bounded only by the volume threshold used to look.

4. Attempts per address is the discriminator

The two populations separate more cleanly on a ratio than on any attribute either possesses.

[DOCUMENTED] admin/admin attempts and addresses, by country:

[DOCUMENTED] Four countries sit between 100 and 800 attempts per address. Four sit at exactly 1.0. There is no middle.

[INFERRED — confidence HIGH] These are two different activities that happen to use the same string:

• At 1.0 per address — a machine tries admin/admin once, as one entry in a longer list, and moves on. This is commodity scanning. Vietnam, Belgium, the United States and Britain contribute 258 addresses and 261 attempts between them.
• At 400–800 per address — a machine tries admin/admin hundreds of times against the same host over months. This is not scanning. Nothing is being discovered on attempt 4,574 that was not known on attempt 2.

[DOCUMENTED] The ASN breakdown confirms the breadth side. The largest contributor by address count is AS396982 Google LLC with 113 addresses — cloud instances, each attempting once or twice — followed by Viettel Group (AS7552) with 61 and Viettel Corporation (AS24086) with 24. TechTies (AS197170) contributes 59 addresses, consistent with the fleet's 761-entry list containing admin/admin as one ordinary line, attempted 2–4 times per node.

[INFERRED — confidence MEDIUM] A hundred and thirteen Google Cloud instances attempting the same default credential is what rented, disposable scanning infrastructure looks like from the receiving end. Letter H takes the institutional question of who rents it; what matters here is that the shape of their activity — one attempt, then gone — is the opposite of the beacons'.

The second word, and who does not use it

[DOCUMENTED] admin/123456 is narrower on every axis: 10,749 attempts, 203 addresses, 31 autonomous systems, 20 countries, 106 active days — against admin/admin's 534 addresses, 152 ASNs, 46 countries and 132 days.

[DOCUMENTED] Five machines account for 10,484 of 10,749 attempts — 97.53%. The concentration is tighter than admin/admin's 94.64%. And Vietnam again sits at exactly 1.0 (81 addresses, 81 attempts), with Switzerland at 1,320 per address across three.

The absence is the finding.

[DOCUMENTED] 87.251.64.176 and 80.66.66.10 do not appear. Neither has ever attempted admin/123456. Both use admin/admin exclusively — 4,141 and 198 attempts respectively, with credential totals of one apiece.

Those are precisely the two machines that Letter C linked by the hand-authored RIPE maintainer ru-avm-1-mnt.

[DOCUMENTED] So a fourth independent signal now separates that pair from the rest of the beacon population, alongside the shared maintainer object, the shared HASSH campaign hassh-eff4c24daffc8532, and shared membership of actor_cluster_014: a one-credential configuration where every other beacon runs two.

⚠ CORRECTED — 2026-07-30. Read third, not fourth. The shared maintainer ru-avm-1-mnt is the object of a sponsoring Local Internet Registry (ORG-PMAV1-RIPE) holding allocations in both 87.251.x and 80.66.x, so it links the two addresses as customers of one registry rather than as machines under one operator. It is removed from the count. The three that remain — the HASSH campaign, the actor cluster, and the one-credential configuration documented in this letter — are all behavioural, and the finding of this section is unaffected: the pair is still separated from the rest of the beacon population by signals nothing else in the corpus shares. Full resolution: TI-2026-103P — The Sponsor.

[INFERRED — confidence MEDIUM-HIGH] Registration evidence and behavioural evidence, gathered by unrelated methods, partition the beacon population the same way. That agreement is worth more than either signal alone, and it is the strongest attribution result in the series so far — stronger than the shared-HASSH association between Private Layer and Omegatech, which Letter C correctly declined to treat as operator-level.

The credential confirms the bursts

[DOCUMENTED] admin/123456's daily timeline independently reproduces both mute bursts from Letter A's census, without reference to them:

[DOCUMENTED] The largest burst in the record and the excursion that prompted this series are both visible as spikes in a single credential's daily counts, from a handful of addresses. This is the census re-derived from the credential side, and it agrees.

[DOCUMENTED] The same timeline shows the June/July transition: through June, admin/123456 runs at a near-constant 91–98 attempts per day from 2 to 5 addresses; from 2026-06-29 it runs at 105–182 per day from 6 to 15. The per-day volume roughly doubles while the address count triples — consistent with a stable beacon population joined by a large, thin-spread fleet.

5. Correction to Letter B

A claim in Letter B is withdrawn.

Letter B established, correctly, that the beacons authenticate at ~100% while the corpus authenticates at 7.2% in the same regime, and concluded that beacon success is a property of the credential rather than of the sensor configuration. That much stands, and the regime test that produced it stands.

Letter B then wrote that the beacons "were never guessing" and "already knew".

[DOCUMENTED] That inference is not supported. admin/admin succeeds on this sensor for every one of 534 addresses that has ever tried it, across 152 autonomous systems and 46 countries — including 113 Google Cloud instances that tried it once each as part of an ordinary commodity list. A 100% success rate on this credential is available to anyone who guesses the single most predictable credential in existence.

The corrected statement: the beacons' success rate reflects the narrowness of their list, not the quality of their knowledge. A machine that only ever attempts credentials this sensor accepts will show 100% success by construction, and that tells you nothing about how it obtained them. The 533 other addresses that succeeded with the same string obtained it by guessing.

What the regime test does still establish is narrower and still useful: the beacons' success is not an artefact of R1's accept-all period. The credential works in R3 as well, so their continued success after 2026-06-29 is real and not a residue of the sensor's earlier permissiveness.

What survives from Letter B untouched:

1. [DOCUMENTED] The five (now ten) beacons hold the large majority of all successful logins.
2. [DOCUMENTED] They have issued zero commands and zero downloads in 23,276+ sessions.
3. [DOCUMENTED] Their cadence is fixed per machine and shares no common factor.
4. [DOCUMENTED] They have never expanded their list by a single character in four months.

Point 4 is the one that still requires explanation, and the credential's ubiquity does not supply it. Guessing admin/admin once is ordinary. Guessing it 4,574 times over four months, on a thirty-minute timer, and never trying a third string, is not. The anomaly was never the credential. It is the repetition.

This is the second correction of an over-reached inference in this series, and the pattern in both is the same: a real measurement (100% success; a stable 0.081 ratio) carried into a claim about intent that the measurement could not support.

6. What the two words are worth

[DOCUMENTED] The daily timeline for admin/admin shows a structural change at the same boundary as everything else in this series. Through mid-June the credential appears in bursts — 2026-06-12: 100 attempts from 3 addresses; 06-15: 101 from 4; 06-18: 63 from 4; 06-21: 104 from 5 — separated by days carrying one to three attempts. From 2026-06-29 onward it runs steadily at 30–75 attempts per day from 8–20 addresses.

[INFERRED — confidence MEDIUM] The pre-boundary pattern is a small number of machines each delivering a large block; the post-boundary pattern is many machines each delivering a few. That is the arrival of the TechTies fleet (Letter A: first contact 2026-06-15 to 06-26) superimposed on a beacon population that was already running. The credential did not change. The population using it did.

[DOCUMENTED] A note on what the twenty successes per fleet job are worth. Letter D found that among a reference node's 40 successful sessions the sensor recorded 5 distinct usernames and 16 distinct passwords. Those twenty openings are entries on the hand-enumerated accept list of §2 — admin/admin, admin/123456, root/root, pi/raspberry and their neighbours. The fleet is not finding weak credentials on this host. It is rediscovering, once every fourteen hours, the contents of a list somebody wrote into a configuration file.

7. What this letter establishes

1. [DOCUMENTED] The corpus holds 52,787 distinct credential pairs.
2. [DOCUMENTED] The most-attempted — root with an empty password, 24,899 attempts from 723 addresses — has never once succeeded, and is [INFERRED, HIGH] auth-method enumeration rather than a credential attempt.
3. [DOCUMENTED] admin/admin succeeds 16,500 times out of 16,500, from 534 addresses in 152 ASNs and 46 countries over 132 days.
4. [DOCUMENTED] Ten machines account for 94.64% of those attempts; the other 524 average 1.69 each.
5. [DOCUMENTED] The beacon population is at least ten, not five — adding Private Layer and w1n siblings, an Omegatech sibling, and two new operators: ZORNTECH WEB SOLUTIONS and Proton66 OOO. One of them was active at 11:58 on the final day of the record.
6. [DOCUMENTED] Attempts-per-address separates the populations absolutely: 799, 555, 400, 99.5 — then 1.0, 1.0, 1.0, 1.0. No middle.
7. [DOCUMENTED] The sensor's accept set is hand-enumerated, not rule-based: admin/password opens, admin/admin123 does not.
8. [DOCUMENTED] Letter B's "they already knew" is withdrawn. The anomaly is the repetition, not the credential.
9. [DOCUMENTED] claude/claude — 203 attempts, 168 addresses, zero successes — dates the refresh of commodity wordlists.

8. What this letter could not establish

• The full 761-entry fleet wordlist. Its size and one duplicate are documented (Letter D); its contents are recoverable only by enumerating the credentials record per address, which has not been done. Its order is not recoverable at all (R13).

✅ CLOSED — Letter H, §6, by not doing what this item proposed. Enumerating per address was never necessary: querying the fingerprint recovers the list directly — 8,699 distinct pairs across the 118-address libssh2_1.11.1 population, each pair appearing at ~46–50 nodes, consistent with each node walking the same list once. Service accounts, game servers (minecraft, ark), pi/raspberry at 364 uses, a root password sweep, and one Russian entry: potok/potok, поток, "flow". The order remains unrecoverable — R13 stands.

• Whether the ten beacons share a list source. They share two strings. Two strings this common are not a fingerprint, and Letter C's ru-avm-1-mnt remains the only hard link between any of them. ⚠ CORRECTED 2026-07-30: that link is withdrawn — ru-avm-1-mnt is a sponsoring LIR's maintainer object. There is now no hard registry link between any two beacons, which makes this item's conclusion stronger, not weaker: every relationship in the beacon population is behavioural. See TI-2026-103P.
• Why 176.53.159.196 and 37.77.150.119 were absent from Letter B. They were: the beacon census was built by ranking on total session volume, and a machine that beacons on one credential ranks lower than one that beacons on two. The selection method, not the world, set the boundary at five.
• What the beacons would do if the credential stopped working. No natural experiment exists in the record: admin/admin has never failed here, in any regime, for anyone. Letter L specifies this as the single most informative test available — and notes that running it would mean changing the sensor, which is a decision about the instrument and not a finding about the adversary.

The last point is worth stating plainly because it is the cheapest experiment in the series. Remove those two entries from the accept list and the beacons must either adapt, stop, or keep transmitting into a door that no longer opens. Each outcome distinguishes hypotheses that four months of passive observation cannot separate. Nothing in this series recommends doing it — a honeypot's value lies partly in not being reconfigured mid-record, as Letter O's three regimes demonstrate at length — but it should be recorded that the question is answerable, cheaply, and that only the sensor's owner can answer it.

Next: Letter F — The Silence. Twenty-three thousand open doors and five files.