The OpenCanary Experience · The Usual Suspect

For two years I watched. In 2025 I kept the evidence — and recognised it.

Eighty million knocks, a credential pool measured for the first time, and eighteen thousand pieces of malware that were almost all the same file. The year the internet stopped being a mystery and became a known quantity.

Scroll, swipe, or use the arrow keys.

The scale · all of 2025

Seventy-nine million — and the curve bends.

Total connections

three sensors, eleven protocols

Days active

365

full year, no gaps

Peak day

9 November 2025

Growth on 2024

+17%

10M → 68M → 80M

The explosive years are over. After a seven-fold jump into 2024, 2025 grew by a sixth. The question stops being how much — and becomes who, and what.

The fleet

The internet picked a favourite.

Balanced in 2024, the three sensors split very differently in 2025 — one of them became a magnet, absorbing more than the other two combined.

Switzerland43,725,065

US-West21,891,091

US-East19,019,017

Switzerland took 55% of all traffic — and its open file share alone logged 4.94 million SMB events out of 5.26M across the fleet. One share quietly became the internet's preferred drop-point.

2025 · protocol detail

Databases drew level with desktops.

RDP · 338926,955,094

MSSQL · 143325,956,057

SSH · 2217,417,257

VNC · 59016,741,135

Telnet · 231,902,235

Redis · 6379408,767

FTP · 2194,094

MySQL · 330672,335

HTTP · 8058,145

GIT · 9418254

MSSQL reached 96% of RDP

The database surge that began in 2024 has all but caught the perennial number one. 26M attempts on a single database port — the internet wants your data, not just your desktop.

No human curve

Hourly volume holds flat from midnight to midnight. Three years running, the same signature: this is machinery, not people, and it does not rest.

Who came knocking

A new map, the same repeat offenders.

Geography

United States 15,652,135 · China 7,252,121 · Germany 6,893,382 · Romania 6,648,608. The US takes a clear first; Romania arrives as a new heavyweight.

The monster

A single Romanian IP — 92.86.69.77 — fired 6,573,742 hits on its own. One host, more than the whole of South Korea.

Repeat offenders

The familiar faces return: 220.120.147.167 (Korea, 3.5M, down from 7M in 2024) and 104.192.6.74, the relentless MSSQL prober, still grinding.

One port, almost two crowns

RDP and MSSQL ran a dead heat all year — 27M and 26M. Two-thirds of everything is now either a desktop login or a database login. The internet has narrowed its aim.

What better instruments revealed

I didn't catch smarter attackers. I built a wider net.

I grew OpenCanary's known-VNC-password list from six entries to around 2,800. Overnight, matched VNC logins jumped from a rounding error to most of them. The attackers never changed — the list did. What it exposed: VNC brute force draws from a small, knowable pool of weak defaults. The blindness was mine; the predictability was always theirs.

Known list · before

passwords I could recognise

Known list · 2025

~2,800

a wider net, on-the-fly matching

VNC now matched

57.9%

3.9M of 6.7M — always there, now visible

Top credential

admin / admin

428,299 attempts

🦠 New on the list: the camera in your hallway

Beyond the Mirai evergreens (vizxv, xc3511, 19,450 each), the climbers are IoT-camera backdoors:

Username	Password	Attempts
root	7ujMko0admin	17,590
root	xmhdipc	16,215
root	xc3511	19,450

7ujMko0admin is a Hikvision factory backdoor; xmhdipc a Dahua/IoT default. The botnets are hunting the camera in your hallway.

Three years, one file

I finally kept the malware. It was the same malware.

2023 caught one binary but couldn't prove it recurred. 2024 purged the captures for space. In 2025 I kept all 18,404 of them — and hashed every one.

Malware files kept

across three sensors

One binary

99.96%

the same file as Genesis 2023

Everything else

files, all year

Sent to VirusTotal

All

every drop, as it landed

23873bf2…412dd ×18,396 RemCom · HackTool.RemoteExec — the Genesis 2023 binary
8d451938…fb590 ×7 repack of 3c2fe308… — same byte size, new signature (evasion)
abd5d6cc…d735 ×1 Trojan.MSIL/Blocker

Three years, three sensors, roughly eighteen thousand drops — and essentially one tool, lightly reskinned. The warehouse was never a market. It was a single product line.

2025

The tripwire became a feed.

Eighty million knocks — the growth slowed, the clarity didn't.

Widen the lens and the noise resolves into known passwords and known files.

The internet's break-in kit has a name, a hash, and a three-year history.

Every byte that landed on the share, I sent to VirusTotal. The canary stopped being a passive trap and became an active intelligence source — the internet drops its tools on me, and I hand them to the world.

This was the year it all became a known quantity. Next: the 2026 quarterly era.

The OpenCanary Experience →