freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Wednesday April 23, 2025

denied by configuration:

 8.217.43.77: 3 Times
 14.29.209.57: 3 Times
 14.103.93.44: 3 Times
 14.103.115.5: 4 Times
 14.103.115.216: 1 Time
 14.103.117.145: 3 Times
 14.103.139.88: 3 Times
 34.101.240.144 (144.240.101.34.bc.googleusercontent.com): 1 Time
 36.40.79.122: 2 Times
 37.193.112.180 (l37-193-112-180.novotelecom.ru): 10 Times
 38.207.132.176: 2 Times
 45.70.100.116 (45-70-100-116.alphanet.psi.br): 1 Time
 45.116.76.227: 12 Times
 45.227.255.120: 1 Time
 47.250.80.158: 1 Time
 49.207.180.112 (49.207.180.112.actcorp.in): 9 Times
 50.6.169.186 (50-6-169-186.unifiedlayer.com): 7 Times
 58.147.171.11 (58.148.171-11.aitlbd.net): 3 Times
 59.12.160.91: 4 Times
 59.36.78.66 (66.78.36.59.broad.dg.gd.dynamic.163data.com.cn): 3 Times
 61.184.3.175: 1 Time
 64.62.156.42 (scan-62-4.shadowserver.org): 1 Time
 68.183.6.60: 4 Times
 80.94.95.125: 11 Times
 80.94.95.155: 4 Times
 80.94.95.189: 11 Times
 81.17.101.40 (vmd150438.contaboserver.net): 14 Times
 82.140.0.119: 1 Time
 85.208.253.107 (static.107.253.208.85.clients.irandns.com): 14 Times
 88.214.48.16: 11 Times
 88.214.48.17: 29 Times
 88.214.48.18: 25 Times
 92.118.39.90: 36 Times
 93.123.16.135 (moblin.ohost.bg): 1 Time
 101.89.186.252: 8 Times
 101.126.30.240: 5 Times
 103.129.221.147: 4 Times
 103.150.159.1: 12 Times
 103.172.20.218: 7 Times
 103.186.1.120 (ip103-186-1-120.cloudhost.web.id): 15 Times
 103.197.184.162: 5 Times
 103.197.184.167: 4 Times
 104.205.140.176 (d104-205-140-176.abhsia.telus.net): 2 Times
 106.12.153.108: 5 Times
 108.85.73.157 (108-85-73-157.lightspeed.wlfrct.sbcglobal.net): 16 Times
 111.67.194.235: 3 Times
 115.91.91.182: 11 Times
 115.151.72.7: 9 Times
 116.105.219.55: 4 Times
 116.110.124.234: 5 Times
 116.110.209.90: 3 Times
 118.69.174.86: 11 Times
 118.122.93.139: 4 Times
 119.188.168.235: 3 Times
 120.48.98.125: 4 Times
 122.96.151.110: 23 Times
 125.91.34.106: 1 Time
 140.246.58.66: 7 Times
 146.56.225.147: 5 Times
 146.190.22.40 (academy.smarttourisme.net): 11 Times
 146.190.60.168: 14 Times
 150.165.85.123: 1 Time
 160.19.78.247: 5 Times
 160.191.52.84: 5 Times
 162.191.94.25: 16 Times
 163.172.98.52 (163-172-98-52.rev.poneytelecom.eu): 11 Times
 167.172.153.88: 10 Times
 170.64.187.72: 1 Time
 171.244.40.20: 7 Times
 171.251.25.13 (dynamic-ip-adsl.viettel.vn): 4 Times
 176.37.60.16 (host-176-37-60-16.b025.la.net.ua): 5 Times
 178.205.167.92: 2 Times
 181.94.225.221 (host-221.181-94-225.personal.net.py): 12 Times
 187.49.152.12 (ns3.entertelecom.com.br): 1 Time
 193.32.162.89: 31 Times
 193.32.162.135: 4 Times
 193.32.162.136: 4 Times
 193.176.23.6: 25 Times
 193.176.23.7: 28 Times
 195.211.191.125: 2 Times
 196.251.66.71: 5 Times
 196.251.67.42: 5 Times
 196.251.70.234: 4 Times
 196.251.87.74: 5 Times
 196.251.88.103: 1 Time
 197.5.145.121: 12 Times
 197.243.14.52: 11 Times
 200.225.247.89 (netsite_fac-200-225-247-089-flat.dynamic.idial.com.br): 8 Times
 209.38.37.108: 3 Times
 218.51.148.194: 14 Times
 218.78.104.226: 5 Times

system login attempted:

 nobody : 1 Time
 root : 673 Times
 sync : 2 Times
 uucp : 2 Times

received disconnect:

  [preauth] : 216 Times
 Bye Bye [preauth] : 736 Times
 Bye [preauth] : 44 Times
 Client disconnecting normally [preauth] : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 3 Times
 error: kex_exchange_identification: read: Connection reset by peer : 16 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 8 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 8 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 8 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 8 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 8 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 8 Times

dictionary attacks: 391 unique usernames.

 1 1234 123456 a3user abc abhi abi adama adc adfexc Admin admin admin1
 Administrator administrator agente ai aleo aleonode ali alien aliyun amir
 amit anonymous ansible anton app appuser arad ariel asad asw atlas aurora
 aws azureuser baikal bbs bea bob book boss bot broadway bruno chris cisco
 citel client clinique config contabilidad cook copier cosmos CSG csserver
 ctarazona cuckoo dani daniel daoperator dcm4chee debian deep default Demo
 demo demos deploy deploybot deployhq desktop dev developer device devops
 diego director dispatch dxu ec2-user edge egor elaine elastic elena
 elsearch emcali emerald etirama exam factorio fauzi finance fist florin
 frank freedom freshlogs ftp ftproot ftpuser gcs ghazi git gitlab-runner
 gnome gns3 grafana grant green guest guest1 hadoop hajar hello helpdesk
 hljut hospital hscroot hubble huong IEUser images info informix init
 installer isa isis isp it ivan james jane jay jayesh jc jester jesus
 jimmy joanne kafka kevin keycloak kira kitchen kjs kk kodi kube laci
 lby librenms lighthouse lina liquidator liquidity liujie liull liuyan
 livia loginuser lord lpadmin luke lwang maestro mahsa mapr maria massa
 master mata mathias maxadmin media metabase mgeweb michael michalel
 michi minecraft mmx mohammad monitor moth3r moussa munin mutua mysql
 nagios nam namada netlink network3 nexus nf nfs nikhil NL5xUDpV2xRa
 node nodeoperator nodeuser (none) nsl odoo odoo8 office oliver omnia
 oneadmin onkar onlime_r OO oo open openhabian openkm openvpn operator
 ops optimism oracle osmc oss pablo panel parking pascal patrick pavel
 penis pi pion pku PLMIMService pos post postgres practice primenet
 pritchard probe public qa qsrvbas rajeev raju relay rizki rke rohan
 ronny roo rootadmin rose router royal runner sa sahar samsung samuel
 sc scan scott sdbadmin seafile sean secure security sendmail service
 setup sftp shin shutdown silvia slave smita snark snarkOS snarkos sol
 solana squid ssh sshuser sss steam story student student3 su sunrise
 super superadmin superman superuser support support1 svn swapnil syp
 sysadm system taufik team1 teamspeak tech telco telecomadmin telekom
 temp tesla TEST test test2 test3 testserver testuser tfsc thor tian
 tmpuser toby topstd tp training ts3 tt1 tutor tutu tv tx ubnt ubuntu
 uftp usario user user04 user1 user2 user4 useradmin userftp username
 vagrant validator verify vignesh vijay viper vitaly vivek vod vpn
 waf wanghy wangrui wangyongxin wasadmin wcs wcy weather web WebAdmin
 webadmin weblogic webmaster webmin wesley whj wilson wolli wwUser www
 xcwang xingxing xr xray yogesh zahid zhangfeng zhangsan zhf zihan zs