After 30 days monitoring a global SSH honeypot network, I analyzed data from 15 servers across 5 VPS providers. The setup captured 1,531,053 login attempts from 6,790 unique IPs using 131,922 credential pairs. 60.1% of attackers originated from Asia, though login attempts skewed toward Europe (60.2%). The Netherlands led with 264.3K attempts, while Romania averaged 2,646 attempts per IP—the highest ratio. 1314 distinct ASNs were identified, with AS197170 Tech Ties Inc. responsible for 29.3% of attempts.

Top credentials included 'root'/'root' (3,861 attempts) and 'root'/'password' (3,449). Common usernames were 'root' (64.8K), 'admin' (67.7K), and 'ubuntu' (42.9K). Geographically, 60% of honeypots reside in Europe, and credentials were percent-encoded for lossless data capture. Privacy restrictions prevent publishing attacker IPs, though future updates may address this.