These are the 20 most common passwords based on 10,000 analyzed by Acunetix

Are these one of your password

Top 20 most common passwords:

1. 123456 – 64
2. 123456789 – 18
3. alejandra – 11
4. 111111 – 10
5. alberto – 9
6. tequiero – 9
7. alejandro – 9
8. 12345678 – 9
9. 1234567 – 8
10. estrella – 7
11. iloveyou  – 7
12. daniel  – 7
13. 000000  – 7
14. roberto  – 7
15. 654321  – 6
16. bonita  – 6
17. sebastian  – 6
18. beatriz  – 6
19. mariposa  – 5
20. america  – 5

While that shows some people aren’t exercising caution in securing their e-mail accounts, other statistics reveal that many people are putting more thought into it.

For instance, 30 percent used a combination of upper-and lower-case numbers and letters. Twenty-two percent of the passwords used six characters, 14 percent used seven, 21 percent used eight, and 12 percent used nine characters. One account even had a password that was 30 characters long.

While many people say that this is all the act of phising but  Mary Landesman, senior security researcher at ScanSafe, theorizes that passwords were obtained by a data-stealing Trojan horse and not phishing.Among other reasons, Landesman notes that usernames often appear multiple times with the same password except for a slightly different spelling. Also, she said the “@” separating the username from the account is not always present, which could indicate that the data was pieced together from a form or was extracted from a larger set of data.

Following are some of the facts

* The list contained just over 10,000 records of usernames beginning with A or B.
* 657 of the passwords were used more than once but only 1666 of the records shared the same password – indication that the majority of impacted users were striving for unique passwords.
* Not all of the 1666 password sharing records were unique. 1369 of the records were repeat usernames that appeared more than once – some as many as five times.
* 123456 was the most frequently used password, but it appeared only 63 times out of the +10,000 records.
* Though the A/B list did contain mainly Windows Live accounts (which includes MSN, Hotmail, and live.com), there was a smattering of other accounts on the list as well. Included were gmail, yahoo, aol, prodigy, neuf, latinmail, telefonica, vodafone, and a few dozen others.

Asked to comment on Landesman’s speculation, Microsoft and Yahoo spokespeople said the companies still think the passwords were phished.