Default Router WPA KeySpace Wordlists
The passwords that come default on wireless routers may seem secure, a bunch of random letters and numbers. But all is not as it seems, for whatever reason many ISPs restrict the keyspace of the passwords that come on their routers. For example in the UK, once you sign a contract for broadband with BT you will get sent a BT homehub router with a default password that looks totally random, however that password will actually only contain numbers 2-9 and letters a-f and will always be 10 characters long, armed with this information cracking a wpa2 key becomes a lot easier and a lot faster. In the above linked video Seytonic explains all. Down below is a list of default router password keyspaces Seytonic has collated.
BTHomeHub-XXXX - [0-9a-f] Len: 10
BTHomeHub2-XXXX - [2-9a-f] Len: 10
BTHub3 - [2-9a-f] Len: 10
BTHub4 - [2-9a-f] Len: 10
BTHub5 - [2-9a-f] Len: 10
BTHub6 - [0-9a-zA-Z] Len: 10 or 12
ThomsonXXXXXX - [0-9a-f] Len: 10
PlusnetWireless-XXXXXX - [0-9A-F] Len: 10
belkin.xxx - [2-9a-f] Len: 8
belkin.xxxx - [2-9a-f] Len: 8
Belkin.XXXX - [0-9A-F] Len: 8
Belkin_XXXXXX - [0-9A-F] Len: 8
BELL### - [0-9A-F] Len: 8
BELL#### - [0-9A-F] Len: 10
TP-LINK_###### - [0-9A-F] Len: 8
TDC-#### - [0-9a-f] Len: 9
TNCAPXXXXXX - [0-9A-F] Len: 10
WLAN1-XXXXXX - [0-9A-F] Len: 11
TelstraXXXXXX - [0-9A-F] Len:10
BigPondXXXXXX - [0-9A-F] Len:10
2WIREXXX - [0-9] Len: 10
ONOXXXX - [0-9] Len: 10
DJAWEB_##### - [0-9] Len: 10
TIM_PN51T_XXXX - [0-9] Len: 8 - WPS pin is 12345670... and WPS can't be disabled...
INFINITUM#### - [0-9] Len: 10
NETGEARXX - Adjective + Noun + 3 Digits
CenturyLinkXXXX - [0-9a-f] Len: 14
BrightBox-XXXXXX - [??] Len: 8
EEBrightBox-XXXXXX - [3 word with hyphens]
Orange-XXXX - [2345679ACEF] Len: 8
TALKTALK-XXXXXX - [ABCDEFGHJKMNPQRTUVWXY346789] Len: 8
AOLBB-XXXXXX - [0-9A-Z] Len: 8
UPCXXXXXXX - [A-Z] Len: 8
SKYXXXXX - [A-Z] Len: 8
Tech_XXXXXXXX - [A-Z] Len: 8
Keenetic-XXXX - [a-zA-Z0-9] Len: 8 (Might be scope to reduce the charset but even so, large key-space)
Virgin Media [abcdefghjklmnpqrstuvwxyz] Length 8 i and o omitted.
VMXXXXXXX-2G [abcdefghjklmnpqrstuvwxyz] Length 8 i and o omitted.
VMXXXXXXX-5G [abcdefghjklmnpqrstuvwxyz] Length 8 i and o omitted.
VMXXXXXXX [0-9a-zA-Z] Len: 12
FRITZ!Box Fon WLAN #### - [0-9] Len: 16
EasyBox-###### - [0-9A-F] Len: 9
MobileWifi-xxxx - [0-9] Len: 8
3Wireless-Modem-XXXX - [0-9A-F]
UNITE-XXXX - [0-9] Len: 8
Verizon MIFIXXXX XXXX - [0-9] Len: 11
VirginMobile MiFiXXXX XXX - [0-9] Len: 11
E583x-xxxx - [0-9] Len: 8
E583x-xxxxx - [0-9A-F] Len: 8
Domino-XXXX - [0-9A-F] Len: 8
Netia-XXXXXX - [0-9a-f] Len: 13
Telecom-XXXXXXXX - [not-sure]