Default-Credential Botnet Sweep

Default-Credential Scanner

Hardening rate 15%

Sweep speed 1.0×

Botnet size

0 / 0

Hardened devices

Compromise rate

0 dev/s

Rejected attempts

Sweep pass

Time to full recruit

–

How it works

The credential space that ships on consumer IoT hardware is tiny — a handful of username/password pairs (admin/admin, admin/12345, root/blank…) cover most cameras, routers and smart plugs out of the box. A scanner doesn't need to guess: it just tries that short list against every device it finds. Here, the sweep front scans the grid left to right; any device still on its factory default flips to compromised (red) the instant the sweep reaches it and is pulled into the growing botnet swarm around the command-and-control hub. A device that forced a unique password at first boot rejects every one of those same attempts — the flash means "tried and refused" — no matter how many times the sweep comes back around.

P(compromise) = 1  if password == factory_default
P(compromise) = 0  if password unique-per-device
botnet_size ≈ N × (1 − hardening_rate)

Hardening rate — the share of devices that were forced to set a unique password on first boot. Drag it up and watch the eventual botnet size collapse even though the scanner tries just as hard.
Sweep speed — how fast the scanner works through the address space. It changes how quickly the (unhardened) population gets recruited, not how much of it eventually falls.
Compromise rate — devices/second currently joining the botnet; near-instant collapse to zero once the unhardened pool is exhausted, however high the hardening rate.
Rejected attempts — every time the sweep re-tries a hardened device it fails again; this counter keeps climbing pass after pass while the botnet counter stays flat.

Real-world relevance: this is exactly how Mirai-class botnets grew to hundreds of thousands of devices in hours — not through sophisticated exploits, but by exhausting a credential list of a few dozen entries against an internet full of devices nobody ever logged into.

Default credentials Hardened (unique password) Compromised — in botnet Sweep front

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.