Actualizado: abril de 2026
Top 100 Usernames SSH Atacados
Los nombres de usuario mas utilizados en ataques de fuerza bruta SSH. Evita usar nombres de usuario predecibles.
| # | Username | Intentos | IPs |
|---|---|---|---|
| 1 | root | 4,984 | 338 |
| 2 | admin | 1,495 | 107 |
| 3 | ubuntu | 1,239 | 198 |
| 4 | solana | 1,232 | 13 |
| 5 | sol | 1,134 | 12 |
| 6 | user | 631 | 132 |
| 7 | solv | 366 | 8 |
| 8 | 345gs5662d34 | 242 | 145 |
| 9 | test | 241 | 122 |
| 10 | postgres | 217 | 93 |
| 11 | steam | 161 | 104 |
| 12 | oracle | 155 | 56 |
| 13 | lighthouse | 139 | 8 |
| 14 | default | 131 | 11 |
| 15 | sa | 127 | 12 |
| 16 | deploy | 119 | 70 |
| 17 | ftpuser | 112 | 71 |
| 18 | odoo16 | 108 | 9 |
| 19 | validator | 101 | 7 |
| 20 | support | 98 | 18 |
| 21 | node | 84 | 9 |
| 22 | frappe | 74 | 54 |
| 23 | ali | 71 | 56 |
| 24 | latitude | 70 | 3 |
| 25 | guest | 69 | 20 |
| 26 | mapr | 69 | 4 |
| 27 | ftp | 68 | 19 |
| 28 | ubnt | 66 | 16 |
| 29 | firedancer | 64 | 5 |
| 30 | telnet | 61 | 7 |
| 31 | claude | 60 | 42 |
| 32 | pi | 59 | 16 |
| 33 | git | 59 | 43 |
| 34 | dev | 58 | 42 |
| 35 | administrator | 58 | 15 |
| 36 | odoo | 56 | 49 |
| 37 | teamspeak | 55 | 46 |
| 38 | raydium | 52 | 4 |
| 39 | n8n | 51 | 43 |
| 40 | vpn | 48 | 45 |
| 41 | user1 | 48 | 26 |
| 42 | server | 46 | 42 |
| 43 | bot | 45 | 32 |
| 44 | service | 44 | 6 |
| 45 | slv | 43 | 1 |
| 46 | testuser | 42 | 34 |
| 47 | supervisor | 42 | 6 |
| 48 | minecraft | 41 | 21 |
| 49 | mother | 39 | 4 |
| 50 | ethereum | 37 | 4 |
| 51 | hadoop | 37 | 11 |
| 52 | solnode | 36 | 1 |
| 53 | grafana | 34 | 3 |
| 54 | jupyter | 34 | 3 |
| 55 | solr | 34 | 5 |
| 56 | sammy | 34 | 33 |
| 57 | jibs | 32 | 3 |
| 58 | 3d | 32 | 3 |
| 59 | mysql | 31 | 9 |
| 60 | User-Agent: Go-http-client/1.1 | 27 | 7 |
| 61 | www | 27 | 13 |
| 62 | system | 27 | 12 |
| 63 | Administrator | 26 | 3 |
| 64 | tomcat | 26 | 11 |
| 65 | GET / HTTP/1.1 | 26 | 16 |
| 66 | minima | 25 | 3 |
| 67 | cexadmin | 24 | 1 |
| 68 | operator | 24 | 8 |
| 69 | cexuser | 24 | 1 |
| 70 | a | 23 | 12 |
| 71 | operation | 23 | 2 |
| 72 | ps | 23 | 2 |
| 73 | ops | 22 | 3 |
| 74 | username | 22 | 13 |
| 75 | deployer | 22 | 17 |
| 76 | es | 22 | 7 |
| 77 | esuser | 22 | 10 |
| 78 | ec2-user | 21 | 18 |
| 79 | cisco | 21 | 6 |
| 80 | test2 | 21 | 20 |
| 81 | daron | 20 | 1 |
| 82 | opadmin | 20 | 2 |
| 83 | elasticsearch | 20 | 14 |
| 84 | ania | 20 | 1 |
| 85 | test1 | 20 | 17 |
| 86 | yahaira | 20 | 1 |
| 87 | elvin | 20 | 1 |
| 88 | waylon | 20 | 1 |
| 89 | makiya | 20 | 1 |
| 90 | adamaris | 20 | 1 |
| 91 | nexus | 19 | 8 |
| 92 | soltech | 19 | 1 |
| 93 | psadmin | 19 | 2 |
| 94 | banx | 19 | 1 |
| 95 | soldev | 18 | 1 |
| 96 | app | 18 | 6 |
| 97 | debian | 18 | 10 |
| 98 | appuser | 18 | 16 |
| 99 | Accept-Encoding: gzip | 18 | 11 |
| 100 | solscript | 18 | 1 |
RECOMENDACIONES
- •Deshabilita el login de root por SSH
- •Usa nombres de usuario unicos y no predecibles
- •Implementa autenticacion por clave publica
- •Configura fail2ban para bloquear IPs