Harvesting SSH Credentials: Insights from My Honeypot Network

That doesn't look to me like it would find many real credentials. It is collecting the credentials that automated bots are trying to use, some of them, perhaps many of them, will be credentials that someone somewhere is using for something, but unless you are planning an Internet wide scan yourself using those credentials to try login to something is likely to be fruitless.

I'd be more curious to know what these SSH scanner bots actually do if they manage to log in. Automated recon, install spambot/cryptominer/phishing site, something else?

Last time I saw this an obscure single letter root password was still "secure", now days seems like almost all non-alphanumeric chars works. % is my new root password it still has not been brute forced.

No "credentials" are being "harvested" here. It's all worthless data, save for the statistics.

Do most installations create a git user account with login permissions?

Having a root password of "toor" is very clever. Nobody will figure that one out.