freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Thursday April 17, 2025

denied by configuration:

 2.59.152.72: 22 Times
 2.228.25.92 (2-228-25-92.ip189.fastwebnet.it): 19 Times
 14.103.113.213: 4 Times
 14.103.120.70: 6 Times
 14.103.127.58: 6 Times
 14.103.127.235: 3 Times
 14.103.228.246: 6 Times
 14.116.250.8: 5 Times
 14.225.3.79: 7 Times
 27.72.31.67: 1 Time
 36.89.28.139: 18 Times
 36.255.220.190: 18 Times
 37.32.13.102: 21 Times
 46.101.74.125: 14 Times
 47.250.80.158: 1 Time
 73.63.161.21 (c-73-63-161-21.hsd1.ca.comcast.net): 9 Times
 77.95.201.161: 4 Times
 80.94.95.241: 5 Times
 82.207.8.202 (202-8-207-82.pool.ukrtel.net): 7 Times
 84.42.46.202 (net-84-42-46.tts.debryansk.ru): 14 Times
 88.214.48.16: 8 Times
 88.214.48.17: 24 Times
 88.214.48.18: 25 Times
 91.126.218.79 (cli-5b7eda4f.ast.adamo.es): 1 Time
 92.118.39.57: 5 Times
 93.123.16.135 (moblin.ohost.bg): 22 Times
 94.55.216.168: 16 Times
 101.36.119.50: 21 Times
 103.70.114.33: 1 Time
 103.70.115.15: 1 Time
 103.124.100.115: 14 Times
 103.186.1.129 (ip103-186-1-129.cloudhost.web.id): 18 Times
 103.242.13.96: 2 Times
 106.12.153.108: 3 Times
 111.68.98.152 (111.68.98.152.pern.pk): 19 Times
 116.110.18.91: 5 Times
 116.110.114.198: 3 Times
 116.193.191.251 (ip116-193-191-251.cloudhost.web.id): 19 Times
 118.122.93.139: 5 Times
 118.193.43.167: 19 Times
 118.193.47.50 (mail.,0663zs.cn): 17 Times
 119.246.15.94 (119246015094.ctinets.com): 21 Times
 120.48.98.125: 2 Times
 122.96.151.110: 11 Times
 135.236.224.91: 2 Times
 143.110.241.64: 3 Times
 146.190.22.40 (academy.smarttourisme.net): 9 Times
 152.32.215.203: 21 Times
 154.92.23.218: 9 Times
 154.221.21.15: 1 Time
 160.19.79.239: 2 Times
 160.191.52.73: 1 Time
 171.251.20.157 (dynamic-ip-adsl.viettel.vn): 3 Times
 175.205.204.94: 3 Times
 180.100.217.164: 11 Times
 182.40.195.12: 2 Times
 182.43.226.211: 17 Times
 185.4.179.226: 21 Times
 185.74.4.20: 21 Times
 190.202.71.102: 16 Times
 190.228.95.181 (181.95.228.190.telecom.com.ar): 12 Times
 193.32.162.89: 31 Times
 193.176.23.6: 24 Times
 193.176.23.7: 24 Times
 195.211.191.125: 5 Times
 196.189.87.177 (aii.et): 3 Times
 196.251.69.116: 1 Time
 196.251.70.234: 1 Time
 196.251.85.34: 1 Time
 196.251.87.35: 1 Time
 196.251.87.74: 2 Times
 196.251.88.103: 1 Time
 202.51.214.98: 13 Times
 203.45.194.190: 6 Times
 209.38.27.191: 1 Time
 222.222.220.108 (108.220.222.222.broad.sj.he.dynamic.163data.com.cn): 1 Time
 223.15.246.49: 11 Times

system login attempted:

 bin : 1 Time
 games : 1 Time
 mail : 1 Time
 nobody : 1 Time
 root : 1057 Times
 www-data : 1 Time

received disconnect:

  [preauth] : 570 Times
 Bye Bye [preauth] : 940 Times
 Bye [preauth] : 14 Times
 Client disconnecting normally [preauth] : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.0" : 1 Time
 error: kex_exchange_identification: read: Connection reset by peer : 12 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 6 Times

dictionary attacks: 347 unique usernames.

 123456 1502 a3user abc abhi ac acc active adm ADMIN admin admin08
 admin1 Administrator administrator adminz advance alex alien amalia amin
 analytics andres anonymous ansible apache apps arcgis arjun artem arun
 as asd asus ava avahi azureuser BACKUP bitrix bitwarden bnb boss bot
 brooklyn build camera cardano casaos celeryuser centos cgadmin cheng
 cisco config connect contacto crystal dbg dci default DEMO Demo demo
 deploy desktop dev diogo draytek drcomadmin eacadm ec2-user edubook
 een emcali engineer erik es esearch ethereum EXAMPLES explore f fail
 fiscal forest frappe freelancer freshlogs ftp ftp_user ftpuser ftpuser2
 ganesh gaurav gautam giorgio git global go golf guest hadoop hammad
 harry huang icp info install installer intern it ivan jack jacob james
 jamila jazmin jeff jenkins jerry jesus Jirka joggler jorge julian kamil
 kevin kiosk kodi lakshmi letmein lh liang librenms lighthouse linkdood
 loginuser louis ltc luke main maks maman manage mary master max media
 mgts michael michalel michel mike misp mohit mother mts mycat myftp mysql
 mysqld mythtv myuser natasha netlink new newuser NL5xUDpV2xRa noc node
 (none) NSA nxuser ocean odoo odoo15 office ogpbot okx oleg omnia oneadmin
 onlime_r oo op openhabian oracle pb phil pi piotr player PLMIMService pls
 postgres ppr presentation prince printer prof prueba psg psybnc public
 pujie pw qa qiong qsrvbas radio rajesh rajiv ravencoin renyun ricky
 riscv rokos root2 rose runner ruslan ryan sa saara sadmin sai salavat
 sameer samp sample sasaki scan scanner scm sdn se security selenium
 sergey server server1 service setpriv sftp shib shop shutdown slave
 snarkos sol solana solutec spam spring squid srt st status steam sunil
 super superadmin superman support support1 svn sysadm sysadmin system
 szj tableau tan temp tempuser terra TEST test test1 test11 test2 test4
 tester testftp testpass testssh testuser tezos tom tomcat toor tpuser
 trouble uat ubnt ubuntu uni user user002 user01 user1 user123 user2
 user3 userftp USERID vagrant valera vali validator vbox vick viewer
 vincent virtualbox vitaly vmware vpn vpnuser vscode vyatta vyos walle
 wang wasadmin watch web webadmin webapp webmaster webmin ws wsq wwUser
 www xbox xh xiwen xray yangfan yzx zabbix zain zcm zh zhangsan zhaoxj zx