It's been a month since I activated the honeypots (ssh, telnet) on my Turris router.
It didn't take even a day. In under a month I collected and sent the following data.
Most popular username
root — no one will be surprised. Percentage-wise that's 95% of all submitted login names.
Most popular password
cisco — almost 20%, which is quite a surprise. I was expecting one of: root (9%), admin (7%) or 123456 (3%)
Most popular username+password combo
root:cisco
What the attacker usually wanted
After logging in, a few things were typically checked: what kind of system it is and how much free RAM it has.
Curiosities
A DDoS script — my router could have been part of a large attack group without my knowledge.
An IRC server — someone apparently wanted to use my router as an IRC server to control a botnet. The attacker trying root:cisco was most likely a machine (probably an infected PC or router). I conclude this from the fact that it would always log in, check the architecture and available RAM, then leave. The connection lasted seconds — a human wouldn't do that. Attackers in recent days behave similarly: they log in, type echo -n test, and leave.
More interesting findings can be found in the post Who's poking around in the Turris ssh honeypot