Some Basic Credential and Country Analysis of Incoming Mirai (IoT Botnet) Traffic

I’ve been messing with Robert Graham’s TelnetLogger project today and captured some IPs and credentials over around two hours.

I was curious of two things:

1. Which credentials would be most popular

2. Which were the most common source IPs

The listener has options for capturing both via:

telnetlogger -p passwds.txt -i ips.txt

What I did was create a simple script (HoneyCredIPTracker) that processes the output. It basically summons the all-powerful combo of:

sort | uniq -c | sort -nr

Fascinating to see which countries are trying most often, and what credentials they’re trying the most.

You can get the script here.