Unfortunately, in my configuration, I can't technically verify that. My current honeypot configuration has 3 public IP addresses NAT'd to one internal IP with varying ports made available to the public. As far as the logging system is concerned, one internal IP address logged all of the connections. This means that one attacker may be targeting what looks like an unsecured email system at one IP, and another might be targeting what looks like an unsecure web server at another, etc., so the data is a skewed from the get-go from what we would expect to see with Zipfs law. Also, attackers only get from 5 minutes to 9 minutes to attack the honeypot. They don't get to hammer away at it indefinitely because our firewall uses the data the honeypot collects to block traffic to all assets owned by my employer.

In the future, when adding more honeypots to the system, I'll likely add an individual honeypot for each IP so it should be possible to see if it matches up with the pattern. Since, at this very moment, I'm wrapping up the development of the API's to make that happen, I anticipate adding more honeypots on different ISP's to the system soon. Unfortunately though, the data still may be unable to correlate a pattern considering the short time window attackers have to hit the honeypot. For example, after watching attack patterns you can clearly see some attacks are automated choosing to attempt a login 10 times per minute, while others are 1000 times per minute. One is designed to evade firewall countermeasures while the other simply doesn't care. I assume the latter doesn't care because any security footprint not smart enough to block X number of failed logins per minute is probably more likely to be breached so if alarm bells don't go off in the initial probing, it's likely no one will notice the shenanigans they attempt later.

Using the current numbers and a bit of help from chatgpt, I've got the expected Zipfs frequency we should expect to see.

Word Actual Exp Ziff Difference
root 677,853 677,853 0
enable 576,932 338,926 +70.22%
shell 461,379 225,951 +4.19%
admin 228,929 169,463 +35.09%
default 80,896 135,571 -0.04%
user 47,088 112,976 -58.32%
guest 43,916 96,836 -54.64%
system 43,311 84,732 -48.88%
sh 28,833 75,317 -61.71%
support 24,460 67,785 -63.91%

I tried removing the first value to see if we get any closer, and this is what we get:

Word Actual Expected Difference
enable 576,932 576,932 0.00%
shell 461,379 288,466 +59.94%
admin 228,929 192,311 +19.04%
default 80,896 144,233 -43.91%
user 47,088 115,386 -59.19%
guest 43,916 96,155 -54.33%
system 43,311 82,419 -47.45%
sh 28,833 72,116 -60.02%
support 24,460 64,104 -61.84%

I suppose Ziff's law might be a great way to statistically show anomalous activity and might provide more accurate insights into what vulnerabilities attackers are looking for in the short term. I'm going to keep that in mind when building some of my reporting tools since my data sets are getting large enough that finding anomalous behavior can be a bit tricky nowadays.