{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T22:30:07Z","timestamp":1785364207456,"version":"3.55.0"},"reference-count":37,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2025,6,12]],"date-time":"2025-06-12T00:00:00Z","timestamp":1749686400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Slovenian Research and Innovation Agency","award":["V2-2378"],"award-info":[{"award-number":["V2-2378"]}]},{"name":"Slovenian Research and Innovation Agency","award":["V2-24009"],"award-info":[{"award-number":["V2-24009"]}]},{"name":"Slovenian Research and Innovation Agency","award":["P2-0425"],"award-info":[{"award-number":["P2-0425"]}]},{"DOI":"10.13039\/501100004329","name":"Cyber Security of Defence Systems and Critical Infrastructures","doi-asserted-by":"publisher","award":["V2-2378"],"award-info":[{"award-number":["V2-2378"]}],"id":[{"id":"10.13039\/501100004329","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004329","name":"Cyber Security of Defence Systems and Critical Infrastructures","doi-asserted-by":"publisher","award":["V2-24009"],"award-info":[{"award-number":["V2-24009"]}],"id":[{"id":"10.13039\/501100004329","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004329","name":"Cyber Security of Defence Systems and Critical Infrastructures","doi-asserted-by":"publisher","award":["P2-0425"],"award-info":[{"award-number":["P2-0425"]}],"id":[{"id":"10.13039\/501100004329","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Modeling of Threats and Cyberattacks in a Cyber Range of MoD","award":["V2-2378"],"award-info":[{"award-number":["V2-2378"]}]},{"name":"Modeling of Threats and Cyberattacks in a Cyber Range of MoD","award":["V2-24009"],"award-info":[{"award-number":["V2-24009"]}]},{"name":"Modeling of Threats and Cyberattacks in a Cyber Range of MoD","award":["P2-0425"],"award-info":[{"award-number":["P2-0425"]}]},{"DOI":"10.13039\/501100004329","name":"Decentralized Solutions for the Digitalization of Industry and Smart Cities and Communities","doi-asserted-by":"publisher","award":["V2-2378"],"award-info":[{"award-number":["V2-2378"]}],"id":[{"id":"10.13039\/501100004329","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004329","name":"Decentralized Solutions for the Digitalization of Industry and Smart Cities and Communities","doi-asserted-by":"publisher","award":["V2-24009"],"award-info":[{"award-number":["V2-24009"]}],"id":[{"id":"10.13039\/501100004329","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004329","name":"Decentralized Solutions for the Digitalization of Industry and Smart Cities and Communities","doi-asserted-by":"publisher","award":["P2-0425"],"award-info":[{"award-number":["P2-0425"]}],"id":[{"id":"10.13039\/501100004329","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>This study presents one of the most extensive analyses of the lifecycle of leaked authentication credentials to date, bridging the gap between database breaches and real-world cyberattacks. We analyze over 27 billion leaked credentials\u2014nearly 4 billion unique\u2014using a sophisticated data filtering and normalization pipeline to handle breach inconsistencies. Following this analysis, we deploy a distributed sensor network of 39 honeypots running 14 unique services across 9 networks over a one-year-long experiment, capturing one of the most comprehensive authentication datasets in the literature. We analyze leaked credentials, SSH and Telnet session data, and HTTP authentication requests for their composition, characteristics, attack patterns, and occurrence. We comparatively assess whether credentials from leaks surface in real-world attacks. We observe a significant overlap of honeypot logins with common password wordlists (e.g., Nmap, John) and defaultlists (e.g., Piata, Mirai), and limited overlaps between leaked credentials, logins, and dictionaries. We examine generative algorithms (e.g., keywalk patterns, hashcat rules), finding they are widely used by users but not attackers\u2014unless included in wordlists. Our analyses uncover unseen passwords and methods likely designed to detect honeypots, highlighting an adversarial arms race. Our findings offer critical insights into password reuse, mutation, and attacker strategies, with implications for authentication security, attack detection, and digital forensics.<\/jats:p>","DOI":"10.3390\/s25123676","type":"journal-article","created":{"date-parts":[[2025,6,12]],"date-time":"2025-06-12T06:42:48Z","timestamp":1749710568000},"page":"3676","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Beyond the Leak: Analyzing the Real-World Exploitation of Stolen Credentials Using Honeypots"],"prefix":"10.3390","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-8604-7020","authenticated-orcid":false,"given":"Matej","family":"Rabzelj","sequence":"first","affiliation":[{"name":"Faculty of Electrical Engineering, University of Ljubljana, 1000 Ljubljana, Slovenia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2836-5493","authenticated-orcid":false,"given":"Urban","family":"Sedlar","sequence":"additional","affiliation":[{"name":"Faculty of Electrical Engineering, University of Ljubljana, 1000 Ljubljana, Slovenia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,6,12]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Spanca, F., and Salihu, A. (2024, January 30\u201331). Unveiling the Consequences of Data Breaches: Risks, Impacts, and Mitigation in the Digital Age. Proceedings of the 2024 International Conference on Electrical, Communication and Computer Engineering (ICECCE), Kuala Lumpur, Malaysia.","DOI":"10.1109\/ICECCE63537.2024.10823432"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Garkava, T., Moneva, A., and Leukfeldt, E.R. (2024). Stolen Data Markets on Telegram: A Crime Script Analysis and Situational Crime Prevention Measures. Trends Organ. Crime.","DOI":"10.1007\/s12117-024-09532-6"},{"key":"ref_3","unstructured":"Marjanov, T., and Hutchings, A. (2025, January 12\u201315). SoK: Digging into the Digital Underworld of Stolen Data Markets. Proceedings of the 2025 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"102508","DOI":"10.1016\/j.cose.2021.102508","article-title":"Detection Time of Data Breaches","volume":"112","author":"Roumani","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Shandilya, S.K., Datta, A., Kartik, Y., and Nagar, A. (2024). A Study in Attack and Breaches. Digital Resilience: Navigating Disruption and Safeguarding Data Privacy, Springer Nature.","DOI":"10.1007\/978-3-031-53290-0"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"86910","DOI":"10.1109\/ACCESS.2023.3304640","article-title":"Cyberattack Graph Modeling for Visual Analytics","volume":"11","author":"Rabzelj","year":"2023","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Rabzelj, M., Ju\u017eni\u010d, L.\u0160., Volk, M., Kos, A., Kren, M., and Sedlar, U. (2023). Designing and Evaluating a Flexible and Scalable HTTP Honeypot Platform: Architecture, Implementation, and Applications. Electronics, 12.","DOI":"10.3390\/electronics12163480"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Rodrigues, G.A.P., Serrano, A.L.M., Vergara, G.F., Albuquerque, R.d.O., and Nze, G.D.A. (2024). Impact, Compliance, and Countermeasures in Relation to Data Breaches in Publicly Traded U.S. Companies. Future Internet, 16.","DOI":"10.3390\/fi16060201"},{"key":"ref_9","unstructured":"(2025, June 03). The UK and Australian Governments Are Now Monitoring Their Gov Domains on Have I Been Pwned. Available online: https:\/\/www.troyhunt.com\/the-uk-and-australian-governments-are-now-monitoring-their-gov-domains-on-have-i-been-pwned\/."},{"key":"ref_10","unstructured":"Apple (2024, August 30). Password Monitoring. Available online: https:\/\/support.apple.com\/en-gb\/guide\/security\/sec78e79fc3b\/1\/web\/1."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"102","DOI":"10.1007\/978-3-319-24192-0_7","article-title":"Gathering and Analyzing Identity Leaks for Security Awareness","volume":"Volume 9393","year":"2015","journal-title":"Technology and Practice of Passwords"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Malderle, T., W\u00fcbbeling, M., Knauer, S., Sykosch, A., and Meier, M. (2018, January 8\u201310). Gathering and Analyzing Identity Leaks for a Proactive Warning of Affected Users. Proceedings of the 15th ACM International Conference on Computing Frontiers, Ischia, Italy.","DOI":"10.1145\/3203217.3203269"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Graupner, H., Jaeger, D., Cheng, F., and Meinel, C. (2016, January 16\u201319). Automated Parsing and Interpretation of Identity Leaks. Proceedings of the ACM International Conference on Computing Frontiers, Como, Italy.","DOI":"10.1145\/2903150.2903156"},{"key":"ref_14","unstructured":"Jaeger, D., Pelchen, C., Graupner, H., Cheng, F., and Meinel, C. (2016, January 5\u20137). Analysis of Publicly Leaked Credentials and the Long Story of Password (Re-)Use. Proceedings of the 11th International Conference on Passwords, Bochum, Germany."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Feng, R., Yan, Z., Peng, S., and Zhang, Y. (2022, January 21\u201329). Automated Detection of Password Leakage from Public GitHub Repositories. Proceedings of the 44th International Conference on Software Engineering, ICSE\u201922, Pittsburgh, PA, USA.","DOI":"10.1145\/3510003.3510150"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Dupuis, M., Jennings, A., and Renaud, K. (2021, January 6\u20139). Scaring People Is Not Enough: An Examination of Fear Appeals within the Context of Promoting Good Password Hygiene. Proceedings of the 22nd Annual Conference on Information Technology Education, SIGITE \u201921, SnowBird, UT, USA.","DOI":"10.1145\/3450329.3476862"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"13919","DOI":"10.1109\/ACCESS.2025.3528960","article-title":"Advancing Passwordless Authentication: A Systematic Review of Methods, Challenges, and Future Directions for Secure User Identity","volume":"13","author":"Yusop","year":"2025","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"347","DOI":"10.1108\/ICS-11-2019-0132","article-title":"Analyzing the Usage of Character Groups and Keyboard Patterns in Password Creation","volume":"28","author":"Zaxmy","year":"2020","journal-title":"Inf. Comput. Secur."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Thomas, K., Li, F., Zand, A., Barrett, J., Ranieri, J., Invernizzi, L., Markov, Y., Comanescu, O., Eranti, V., and Moscicki, A. (November, January 30). Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134067"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Michalis Polychronakis, M.M. (2017). On the Privacy Impacts of Publicly Leaked Password Databases. Detection of Intrusions and Malware, and Vulnerability Assessment, Proceedings of the 14th International Conference, DIMVA 2017, Bonn, Germany, 6\u20137 July 2017, Springer. Proceedings.","DOI":"10.1007\/978-3-319-60876-1"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Onaolapo, J., Mariconti, E., and Stringhini, G. (2016, January 14\u201316). What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild. Proceedings of the 2016 Internet Measurement Conference, Santa Monica, CA, USA.","DOI":"10.1145\/2987443.2987475"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Yu, F., and Martin, M.V. (2022, January 6\u201310). GNPassGAN: Improved Generative Adversarial Networks for Trawling Offline Password Guessing. Proceedings of the 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Genoa, Italy.","DOI":"10.1109\/EuroSPW55150.2022.00009"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Fraunholz, D., Krohmer, D., Anton, S.D., and Dieter Schotten, H. (2017, January 19\u201320). Investigation of Cyber Crime Conducted by Abusing Weak or Default Passwords with a Medium Interaction Honeypot. Proceedings of the 2017 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), London, UK.","DOI":"10.1109\/CyberSecPODS.2017.8074855"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Fraunholz, D., Zimmermann, M., Anton, S.D., Schneider, J., and Dieter Schotten, H. (2017, January 12\u201313). Distributed and Highly-Scalable WAN Network Attack Sensing and Sophisticated Analysing Framework Based on Honeypot Technology. Proceedings of the 2017 7th International Conference on Cloud Computing, Data Science & Engineering\u2014Confluence, Noida, India.","DOI":"10.1109\/CONFLUENCE.2017.7943186"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1","DOI":"10.12723\/mjs.63.6","article-title":"A Comprehensive Research Study on Low-Interaction Secure Shell Honeypot","volume":"21","author":"Pahal","year":"2022","journal-title":"Mapana J. Sci."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Dodson, M., Beresford, A.R., and Vingaard, M. (2020, January 26\u201329). Using Global Honeypot Networks to Detect Targeted ICS Attacks. Proceedings of the 2020 12th International Conference on Cyber Conflict (CyCon), Tallinn, Estonia.","DOI":"10.23919\/CyCon49761.2020.9131734"},{"key":"ref_27","unstructured":"(2024, June 10). Domain Name Industry Brief, Quarterly Report, Q4 2023. Available online: https:\/\/dnib.com\/articles\/the-domain-name-industry-brief-q4-2023."},{"key":"ref_28","unstructured":"(2024, June 11). Internet Assigned Numbers Authority, Root Zone Database. Available online: https:\/\/www.iana.org\/domains\/root\/db."},{"key":"ref_29","unstructured":"(2024, August 06). Google Play Store: Number of Apps 2023. Available online: https:\/\/www.statista.com\/statistics\/266210\/number-of-available-applications-in-the-google-play-store\/."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Grassi, P.A., Fenton, J.L., Newton, E.M., Perlner, R.A., Regenscheid, A.R., Burr, W.E., Richer, J.P., Lefkovitz, N.B., Danker, J.M., and Choong, Y.Y. (2017). Digital Identity Guidelines: Authentication and Lifecycle Management, Technical Report NIST SP 800-63b.","DOI":"10.6028\/NIST.SP.800-63b"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"427","DOI":"10.1016\/j.cose.2018.03.014","article-title":"Your Culture Is in Your Password: An Analysis of a Demographically-Diverse Password Dataset","volume":"77","author":"AlSabah","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_32","unstructured":"(2024, August 26). University of Illinois at Chicago\u2019s Password Meter\u2014A Visual Assessment of Password Strengths and Weaknesses. Available online: https:\/\/www.uic.edu\/apps\/strong-password\/."},{"key":"ref_33","unstructured":"Apple (2024, August 30). Automatic Strong Passwords. Available online: https:\/\/support.apple.com\/en-gb\/guide\/security\/secc84c811c4\/web."},{"key":"ref_34","unstructured":"(2024, October 08). National Vulnerability Database\u2014CVE-2022-30023, Available online: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-30023."},{"key":"ref_35","unstructured":"Center, S.I.S. (2025, January 16). Fingerprinting SSH Identification Strings. Available online: https:\/\/isc.sans.edu\/diary\/30520."},{"key":"ref_36","unstructured":"Baiardi, F., Briganti, E., Deri, L., Boni, F., and Braccini, G. (2022). Decoding the Cyber Threat Landscape: A Honeypot Data Analysis Across Cloud Providers, Universit\u00e0 di Pisa."},{"key":"ref_37","unstructured":"(2025, June 03). Have I Been Pwned: Check If Your Email Has Been Compromised in a Data Breach. Available online: https:\/\/haveibeenpwned.com\/."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/12\/3676\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T17:50:42Z","timestamp":1760032242000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/12\/3676"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,12]]},"references-count":37,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2025,6]]}},"alternative-id":["s25123676"],"URL":"https:\/\/doi.org\/10.3390\/s25123676","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,12]]}}}