Hello and welcome to the Thursday, April 3, 2025 edition of the Sands and then at Storm Sunners Stormcast.

My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Our S.H Honeypots did pick up some odd username password combinations yesterday.

Now there are a lot of odd username password combinations,

but these sort of cross our thresholds,

what we consider significant.

And looking at it further,

it actually may be somewhat interesting.

The username that we are seeing,

and this was really just last week,

was T-128 and the password 1-2-8-T-Routes.

Turns out this is a Juniper product, actually originally created by 128 technologies.

So that's where the T-128 and 1-2-8 to 8T Routes part comes from.

And this is now Juniper product, part of their Session Smart networking platform.

This is one of the default passwords being used.

There's also root and then the same 1 to 8T routes password that is being used here.

It's not really clear why we saw sort of this search last week.

There is always a little bit scanning for this password combination, but sort of in the single digits,

nothing really that I consider significant. Last week we had it sort of in the single digits, nothing really that I consider significant. Last week,

we had it sort of in the 20,000 attempts per day. So certainly way, way more, multiple orders

of magnitude, it's more than what we usually see for this combination. Now, doing some Googling around

this, I saw some support forum posts

...