What attackers are trying right now
Real, unsolicited login attempts against monitored infrastructure, captured as they happened. Someone scanned, picked a device, and tried to authenticate. This is what they were after — and exactly what they typed.
Loading live capture data…
The last 30 days at a glance
The same capture, summarised: which devices drew the most interest, which credentials were tried most often, and where the traffic came from.
Over the last 30 days, PacketViper recorded 11,658 unsolicited login and reconnaissance attempts from 6,588 unique source IP addresses in 128 countries, against 90 distinct device types. 95 different username and password combinations were tried. Last updated 2026-11-08 10:44 UTC.
The most frequently targeted devices were Cisco Catalyst 2960-X, Ubiquiti Edgerouter, Aruba Networks Arubaos 2930F, Mikrotik Routeros 7 14 and Linux Telnetd 1 0.
Most targeted devices
| Device | Attempts | Unique sources |
|---|---|---|
| Cisco Catalyst 2960-X | 1,488 | 964 |
| Ubiquiti Edgerouter | 1,016 | 614 |
| Aruba Networks Arubaos 2930F | 691 | 436 |
| Mikrotik Routeros 7 14 | 664 | 428 |
| Linux Telnetd 1 0 | 625 | 432 |
| Juniper MX480 | 495 | 337 |
| Aruba CX6300 | 457 | 266 |
| GE Multilin D60 Relay | 449 | 101 |
| Solarwinds Orion | 417 | 248 |
| F5 BIG-IP LTM | 313 | 153 |
| Dell iDRAC9 | 312 | 201 |
| Pulsesecure Pcs | 221 | 93 |
Most-attempted credentials
| Username | Password | Attempts |
|---|---|---|
| admin | admin | 22 |
| root | Zte521 | 11 |
| root | (none) | 7 |
| REALM.com | (none) | 6 |
| root | xc3511 | 5 |
| scan | (none) | 5 |
| Administr | (none) | 5 |
| zgrab | (none) | 3 |
| guest | guest | 3 |
| administrator | (none) | 3 |
| cht | chtngpon | 3 |
| root | admin | 3 |
| root | vertex25ektks123 | 2 |
| 00000000 | (none) | 2 |
| admin | plumeria0077 | 2 |
Where the attempts came from
| Country | Attempts | Unique sources |
|---|---|---|
| United States | 4,649 | 2,162 |
| Britain (UK) | 909 | 705 |
| China | 618 | 430 |
| Ukraine | 439 | 258 |
| Korea (South) | 417 | 194 |
| Russia | 396 | 265 |
| Pakistan | 374 | 281 |
| Argentina | 281 | 161 |
| Netherlands | 279 | 81 |
| Bulgaria | 255 | 72 |
| Brazil | 248 | 186 |
| France | 226 | 171 |
Networks the attempts originated from
| Operator | ASN | Attempts |
|---|---|---|
| AMAZON-02 | AS16509 | 1,090 |
| GOOGLE-CLOUD-PLATFORM | AS396982 | 652 |
| AMAZON-AES | AS14618 | 516 |
| MICROSOFT-CORP-MSN-AS-BLOCK | AS8075 | 511 |
| Hydra Communications Ltd | AS25369 | 437 |
| Korea Telecom | AS4766 | 394 |
| DIGITALOCEAN-ASN | AS14061 | 300 |
| Driftnet Ltd | AS211298 | 229 |
| NetIX Communications JSC | AS52055 | 218 |
| HURRICANE | AS6939 | 213 |
| Chinanet | AS4134 | 202 |
| CHINA UNICOM China169 Backbone | AS4837 | 196 |
How this data is captured
Preemptive defense turns an attacker’s first move into intelligence — before anything of value is touched.
Moving, not static
Static defenses get mapped, and a map is all an attacker needs. Automated Moving Target Defense keeps changing what can be seen and reached, so the picture an attacker assembles is stale before they can act on it. Effort gets spent on ground that has already shifted.
The attempt is the signal
A blocked connection is not a solved problem — it is the beginning of an investigation. Each attempt here carries context: which device drew interest, from where, on which service, and with which credentials. That is what a block count can never tell you.
Credentials, captured intact
The usernames and passwords shown are recorded exactly as submitted. They are the live contents of real attack dictionaries — and a direct answer to the question every operator should ask: would these have worked on my network?
How to read this page
Method
Window: a rolling 30 days of captured activity.
Refresh: the page rebuilds hourly from the live capture store.
Attack Target: the device the source was attempting to authenticate against.
Attempts From Source: that source’s full total for the window, not just the rows shown.
Limits worth stating
Country is derived from the regional internet registry allocation for the source network. That is a registration fact, not a physical location — traffic routed through hosting providers or VPNs will show the registered country of the network, not the operator.
A source address is not a culprit. Many are compromised third-party hosts being used by someone else.
Volume is capped for readability at the 25 most recent attempts per source, so one high-volume scanner cannot fill the table.
Common questions
What usernames and passwords do attackers try most often?
Across the last 30 days the most-attempted combinations were: admin / admin (22 attempts); root / Zte521 (11 attempts); root / no password (7 attempts); REALM.com / no password (6 attempts); root / xc3511 (5 attempts). These are the live contents of real attack dictionaries, recorded exactly as submitted.
Which devices do attackers target most?
The most frequently targeted devices were Cisco Catalyst 2960-X, Ubiquiti Edgerouter, Aruba Networks Arubaos 2930F, Mikrotik Routeros 7 14 and Linux Telnetd 1 0. In total 90 distinct device types drew unsolicited authentication or reconnaissance attempts.
Which countries do these attacks come from?
By volume the largest sources were United States, Britain (UK), China, Ukraine and Korea (South). Country is derived from the regional internet registry allocation for the source network, which is a registration fact rather than a physical location: traffic routed through hosting providers or VPNs shows the registered country of that network, not the operator behind it.
Is this real attack data?
Yes. Every row is an unsolicited attempt against monitored infrastructure, recorded as it happened. Nothing is simulated or synthesised. The page refreshes hourly and shows a rolling 30-day window.
Does a source IP address identify the attacker?
No. Many source addresses are compromised third-party hosts, or shared hosting and VPN exit points being used by someone else. A source address indicates where traffic arrived from, not who is responsible for it.
See It On Your Network
This is one network’s view. Now picture your plant floor.
PacketViper runs inline in OT and IT networks — agentless, non-intrusive, and surgical enough to scope enforcement to a single device instead of an entire subnet.