http://y7egb5vi45k74makeixpfb7jnimfxm3gf233lb3ke2ldonozjk55nvad.onion/mirai_iot_ddos_botnet_analysis.html
The purpose of these scans is to locate
under-secured IoT devices that could be remotely accessed via easily
guessable login credentials—usually factory default usernames and
passwords (e.g., admin/admin). Mirai uses a brute force technique for guessing passwords a.k.a. dictionary
attacks based on the following list: root xc3511
root vizxv
root admin
admin admin
root 888888
root xmhdipc
root default
root juantech
root 123456
root 54321
support ...