Which usernames do attackers actually try? Search 77,737+ usernames from real SSH, FTP, and Telnet brute-force attacks — captured live by our honeypot sensor network.
Enter a username to check
| 2026-03-03 |
| 3 | 345gs5662d34 | 344,625 | ssh | 2026-03-03 |
| 4 | ubuntu | 295,053 | sshsmbmysqltelnetftpmssql | 2026-03-03 |
| 5 | sol | 294,410 | ssh | 2026-03-03 |
| 6 | solana | 234,146 | ssh | 2026-03-03 |
| 7 | postgres | 181,973 | sshpostgresmysqltelnethttpmssql | 2026-03-03 |
| 8 | user | 179,566 | sshtelnetmysqlftppostgressmbsmtphttpsipmssql | 2026-03-03 |
| 9 | test | 150,010 | sshpostgresftpmysqlsmtpsiptelnetmssqlhttpimap | 2026-03-03 |
| 10 | oracle | 115,738 | sshtelnetmysqlhttp | 2026-03-03 |
| 11 | solv | 85,065 | ssh | 2026-03-03 |
| 12 | guest | 83,393 | sshtelnetsmbftpmysqlhttpsipsmtp | 2026-03-03 |
| 13 | centos | 57,252 | sshtelnet | 2026-03-03 |
| 14 | support | 51,280 | sshtelnethttpmssql | 2026-03-03 |
| 15 | mysql | 50,953 | sshmysqlhttp | 2026-03-03 |
| 16 | 0 | 49,184 | sshsiptelnet | 2026-03-03 |
| 17 | debian | 42,084 | sshmssqltelnet | 2026-03-03 |
| 18 | git | 35,737 | sshhttp | 2026-03-03 |
| 19 | hadoop | 35,242 | ssh | 2026-03-03 |
| 20 | pi | 30,863 | sshtelnethttp | 2026-03-03 |
| 21 | backup | 30,606 | sshmysqlmssqlhttpsmtp | 2026-03-02 |
| 22 | administrator | 29,851 | sshsmbtelnetftpmysqlhttpsmtp | 2026-03-03 |
| 23 | validator | 28,997 | ssh | 2026-03-03 |
| 24 | ubnt | 27,711 | sshtelnethttp | 2026-03-02 |
| 25 | default | 25,851 | sshtelnetpostgresftp | 2026-03-03 |
We run a global network of honeypot servers that accept every login attempt. When an attacker tries to brute-force SSH, FTP, Telnet, MySQL, SMTP, or any of our 13 monitored protocols, we record the exact username they tried. This page shows every username we have ever seen in a real attack.
The most common brute-force usernames are “root” and “admin” — the default usernames on most Linux servers, routers, and IoT devices. Attackers scan the entire internet trying these defaults because many systems are never changed from factory settings. If you run a server, check whether your SSH username appears on this list — if it does, you are being targeted. For a broader view of attacker tactics, explore the detection catalog, browse top attacking IPs, or see which countries attacks originate from.
You can look up any username via our REST API, block known attackers with Fail2Ban or iptables, or use the sikker CLI tool from your terminal. All plans include access to this data — view pricing or get started free.