What attackers are trying right now
Real, unsolicited login attempts against monitored infrastructure, captured as they happened. Someone scanned, picked a device, and tried to authenticate. This is what they were after — and exactly what they typed.
Loading live capture data…
The last 30 days at a glance
The same capture, summarised: which devices drew the most interest, which credentials were tried most often, and where the traffic came from.
Over the last 30 days, PacketViper recorded 41,994 unsolicited login and reconnaissance attempts from 12,680 unique source IP addresses in 145 countries, against 59 distinct device types. 499 different username and password combinations were tried. Last updated 2026-08-15 17:50 UTC.
The most frequently targeted devices were Cisco Catalyst 2960-X, Microsoft Active Directory (WS2022), Linux Telnetd 1 0, Mikrotik Routeros 7 14 and VMware ESXi 7.0.
Most targeted devices
| Device | Attempts | Unique sources |
|---|---|---|
| Cisco Catalyst 2960-X | 14,838 | 4,308 |
| Microsoft Active Directory (WS2022) | 4,373 | 583 |
| Linux Telnetd 1 0 | 2,048 | 1,061 |
| Mikrotik Routeros 7 14 | 1,831 | 946 |
| VMware ESXi 7.0 | 1,728 | 218 |
| Dell iDRAC9 | 1,712 | 569 |
| Microsoft Exchange Server 2019 | 1,605 | 571 |
| Cisco ASA 5516-X | 1,307 | 600 |
| Check Point R81 Gateway | 1,188 | 692 |
| Juniper MX480 | 1,023 | 532 |
| Fortinet FortiGate | 948 | 293 |
| Apache Log4j | 946 | 528 |
Most-attempted credentials
| Username | Password | Attempts |
|---|---|---|
| admin | admin | 124 |
| root | Zte521 | 54 |
| root | (none) | 42 |
| root | xc3511 | 37 |
| root | root | 35 |
| user | user | 29 |
| admin | 1234 | 26 |
| default | default | 25 |
| ftp | ftp | 24 |
| *1 | $4 | 24 |
| root | vizxv | 23 |
| ;�admin.$cmd����hello�?>�admin.$cmd����isMaster�… | (none) | 23 |
| admin | admin1234 | 21 |
| root | hi3518 | 21 |
| ubnt | ubnt | 20 |
Where the attempts came from
| Country | Attempts | Unique sources |
|---|---|---|
| United States | 15,083 | 3,624 |
| Pakistan | 2,844 | 431 |
| Britain (UK) | 2,800 | 1,263 |
| Ukraine | 2,483 | 971 |
| Iran | 2,349 | 51 |
| China | 2,286 | 1,004 |
| Russia | 2,047 | 469 |
| Brazil | 1,212 | 601 |
| Argentina | 1,205 | 609 |
| Netherlands | 835 | 164 |
| France | 609 | 342 |
| Canada | 584 | 56 |
Networks the attempts originated from
| Operator | ASN | Attempts |
|---|---|---|
| GOOGLE-CLOUD-PLATFORM | AS396982 | 3,747 |
| MICROSOFT-CORP-MSN-AS-BLOCK | AS8075 | 2,579 |
| Iran Telecommunication Company PJS | AS58224 | 2,158 |
| Akamai Connected Cloud | AS63949 | 1,579 |
| Censys, Inc. | AS398324 | 1,424 |
| Cyber Internet Services Pvt Ltd. | AS9541 | 1,125 |
| DIGITALOCEAN-ASN | AS14061 | 1,029 |
| AMAZON-02 | AS16509 | 971 |
| Rostelecom | AS12683 | 829 |
| Hydra Communications Ltd | AS25369 | 803 |
| Driftnet Ltd | AS211298 | 777 |
| Chinanet | AS4134 | 755 |
How this data is captured
Preemptive defense turns an attacker’s first move into intelligence — before anything of value is touched.
Moving, not static
Static defenses get mapped, and a map is all an attacker needs. Automated Moving Target Defense keeps changing what can be seen and reached, so the picture an attacker assembles is stale before they can act on it. Effort gets spent on ground that has already shifted.
The attempt is the signal
A blocked connection is not a solved problem — it is the beginning of an investigation. Each attempt here carries context: which device drew interest, from where, on which service, and with which credentials. That is what a block count can never tell you.
Credentials, captured intact
The usernames and passwords shown are recorded exactly as submitted. They are the live contents of real attack dictionaries — and a direct answer to the question every operator should ask: would these have worked on my network?
How to read this page
Method
Window: a rolling 30 days of captured activity.
Refresh: the page rebuilds hourly from the live capture store.
Attack Target: the device the source was attempting to authenticate against.
Attempts From Source: that source’s full total for the window, not just the rows shown.
Limits worth stating
Country is derived from the regional internet registry allocation for the source network. That is a registration fact, not a physical location — traffic routed through hosting providers or VPNs will show the registered country of the network, not the operator.
A source address is not a culprit. Many are compromised third-party hosts being used by someone else.
Volume is capped for readability at the 25 most recent attempts per source, so one high-volume scanner cannot fill the table.
Common questions
What usernames and passwords do attackers try most often?
Across the last 30 days the most-attempted combinations were: admin / admin (124 attempts); root / Zte521 (54 attempts); root / no password (42 attempts); root / xc3511 (37 attempts); root / root (35 attempts). These are the live contents of real attack dictionaries, recorded exactly as submitted.
Which devices do attackers target most?
The most frequently targeted devices were Cisco Catalyst 2960-X, Microsoft Active Directory (WS2022), Linux Telnetd 1 0, Mikrotik Routeros 7 14 and VMware ESXi 7.0. In total 59 distinct device types drew unsolicited authentication or reconnaissance attempts.
Which countries do these attacks come from?
By volume the largest sources were United States, Pakistan, Britain (UK), Ukraine and Iran. Country is derived from the regional internet registry allocation for the source network, which is a registration fact rather than a physical location: traffic routed through hosting providers or VPNs shows the registered country of that network, not the operator behind it.
Is this real attack data?
Yes. Every row is an unsolicited attempt against monitored infrastructure, recorded as it happened. Nothing is simulated or synthesised. The page refreshes hourly and shows a rolling 30-day window.
Does a source IP address identify the attacker?
No. Many source addresses are compromised third-party hosts, or shared hosting and VPN exit points being used by someone else. A source address indicates where traffic arrived from, not who is responsible for it.
See It On Your Network
This is one network’s view. Now picture your plant floor.
PacketViper runs inline in OT and IT networks — agentless, non-intrusive, and surgical enough to scope enforcement to a single device instead of an entire subnet.