freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Wednesday May 7, 2025

denied by configuration:

 2.59.152.102: 25 Times
 8.138.155.88: 1 Time
 14.103.25.86: 3 Times
 14.103.93.175: 1 Time
 14.103.107.228: 5 Times
 14.103.114.89: 5 Times
 14.103.115.225: 12 Times
 14.103.116.173: 11 Times
 14.103.118.117: 9 Times
 27.112.79.87 (ip27-112-79-87.cloudhost.web.id): 12 Times
 34.44.67.109 (109.67.44.34.bc.googleusercontent.com): 12 Times
 36.255.3.203: 15 Times
 38.43.76.234: 19 Times
 43.135.173.36: 25 Times
 43.156.18.218: 11 Times
 45.6.188.43: 18 Times
 45.92.8.95 (mail.betaka.online): 11 Times
 45.170.130.157 (45-170-130-157.giganet.net.py): 13 Times
 47.236.174.194: 1 Time
 49.162.227.188: 2 Times
 52.224.240.74: 25 Times
 61.80.179.118: 11 Times
 64.23.178.20: 25 Times
 64.227.170.229: 9 Times
 65.49.1.83 (scan-57d.shadowserver.org): 1 Time
 65.190.102.227 (syn-065-190-102-227.biz.spectrum.com): 13 Times
 72.167.227.34 (34.227.167.72.host.secureserver.net): 12 Times
 80.94.95.112: 44 Times
 80.94.95.115: 17 Times
 80.94.95.116: 17 Times
 80.94.95.125: 2 Times
 80.94.95.241: 32 Times
 80.249.146.240 (booker.co.uk): 19 Times
 81.192.46.49 (adsl-49-46-192-81.adsl.iam.net.ma): 18 Times
 85.208.84.4: 12 Times
 85.208.84.5: 12 Times
 85.208.84.8: 23 Times
 85.208.84.53: 15 Times
 85.208.84.54: 24 Times
 85.208.84.134: 12 Times
 87.156.177.201 (p579cb1c9.dip0.t-ipconnect.de): 3 Times
 88.214.50.39: 24 Times
 88.214.50.40: 24 Times
 91.210.179.185 (91-210-179-185.cl.giga.net.ru): 25 Times
 94.254.0.234 (h-94-254-0-234.na.cust.bahnhof.se): 14 Times
 95.79.112.59 (95x79x112x59.static-business.nn.ertelecom.ru): 4 Times
 96.67.59.65: 41 Times
 99.217.111.162: 3 Times
 101.36.119.50: 12 Times
 101.89.122.25: 8 Times
 101.126.155.124: 9 Times
 102.210.80.6: 13 Times
 103.10.44.105: 13 Times
 103.10.45.57: 14 Times
 103.26.136.173 (mail.gshakti.org): 8 Times
 103.139.193.116 (ip103-139-193-116.cloudhost.web.id): 1 Time
 103.171.52.66: 24 Times
 103.206.139.172: 13 Times
 103.226.139.139 (ip103-226-139-139.cloudhost.web.id): 15 Times
 103.233.206.154: 24 Times
 103.237.144.204: 13 Times
 106.12.153.108: 4 Times
 106.51.1.63 (106.51.1.63.actcorp.in): 14 Times
 106.51.92.114 (106.51.92.114.actcorp.in): 30 Times
 111.67.199.209: 4 Times
 111.67.201.36: 1 Time
 115.190.36.154: 10 Times
 116.71.135.53: 13 Times
 116.110.70.180: 3 Times
 116.110.94.153: 4 Times
 118.69.83.31: 11 Times
 120.48.98.125: 4 Times
 122.96.151.110: 20 Times
 123.59.135.110: 2 Times
 135.125.200.99 (vps-ce374ef1.vps.ovh.net): 15 Times
 136.232.11.10: 6 Times
 144.48.8.100: 13 Times
 147.0.206.46 (syn-147-000-206-046.biz.spectrum.com): 7 Times
 150.241.90.173 (fusciawound.aeza.network): 8 Times
 151.252.84.225 (151.252.84.225.ip.tele-plus.ru): 10 Times
 159.69.38.190 (static.190.38.69.159.clients.your-server.de): 17 Times
 160.191.52.76: 10 Times
 167.71.189.139: 13 Times
 167.71.253.124: 13 Times
 167.99.74.18: 13 Times
 170.64.237.171: 1 Time
 172.105.102.10 (prod08.academyforinternetresearch.org): 1 Time
 175.215.108.143: 2 Times
 178.216.249.74: 13 Times
 181.188.159.138 (SCZ-181-188-159-00138.tigo.bo): 6 Times
 182.44.68.62: 25 Times
 182.61.13.22: 8 Times
 183.91.11.36 (static.cmcti.vn): 25 Times
 185.213.164.160 (static.160.164.213.185.clients.irandns.com): 10 Times
 186.121.205.29 (static-186-121-205-29.acelerate.net): 3 Times
 186.147.178.173 (static-ip-186147178173.cable.net.co): 14 Times
 189.3.191.89: 13 Times
 189.7.193.22 (bd07c116.virtua.com.br): 12 Times
 190.244.25.245 (245-25-244-190.fibertel.com.ar): 11 Times
 193.32.162.134: 55 Times
 193.32.162.137: 33 Times
 194.0.234.16: 6 Times
 194.0.234.19: 28 Times
 194.31.64.6 (sunucu.al): 11 Times
 195.178.110.50: 5 Times
 195.250.72.168: 13 Times
 196.251.67.42: 4 Times
 196.251.85.34: 5 Times
 196.251.85.62: 5 Times
 196.251.87.54: 5 Times
 202.157.184.90: 25 Times
 203.161.60.107 (spacings-neoconservative.vpsrdns.web-hosting.com): 25 Times
 209.38.91.129: 1 Time
 222.222.220.108 (108.220.222.222.broad.sj.he.dynamic.163data.com.cn): 1 Time
 223.220.115.26: 2 Times

system login attempted:

 sshd : 2 Times
 games : 2 Times
 irc : 1 Time
 lp : 1 Time
 nobody : 2 Times
 root : 962 Times
 uucp : 3 Times
 www-data : 2 Times

received disconnect:

  [preauth] : 249 Times
 Bye Bye [preauth] : 1431 Times
 Bye [preauth] : 113 Times
 drop connection #10 from [103.233.206.154]:52580 past MaxStartups : 1 Time
 drop connection #10 from [111.67.201.36]:45660 past MaxStartups : 1 Time
 drop connection #11 from [34.44.67.109]:54806 past MaxStartups : 1 Time
 drop connection #12 from [111.67.199.209]:56140 past MaxStartups : 1 Time
 drop connection #12 from [111.67.201.36]:50476 past MaxStartups : 1 Time
 drop connection #16 from [111.67.201.36]:35738 past MaxStartups : 1 Time
 drop connection #16 from [111.67.201.36]:36014 past MaxStartups : 1 Time
 drop connection #17 from [111.67.201.36]:34062 past MaxStartups : 1 Time
 drop connection #17 from [111.67.201.36]:54086 past MaxStartups : 1 Time
 drop connection #18 from [111.67.201.36]:47800 past MaxStartups : 1 Time
 drop connection #18 from [111.67.201.36]:48046 past MaxStartups : 1 Time
 drop connection #18 from [111.67.201.36]:56890 past MaxStartups : 1 Time
 drop connection #18 from [111.67.201.36]:60478 past MaxStartups : 1 Time
 drop connection #18 from [111.67.201.36]:60752 past MaxStartups : 1 Time
 error: Protocol major versions differ: 2 vs. 1 : 3 Times
 error: beginning MaxStartups throttling : 2 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 2 Times
 error: kex_exchange_identification: read: Connection reset by peer : 12 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 5 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 5 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 5 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 5 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 5 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 5 Times
 exited MaxStartups throttling after 00:00:58, 3 connections dropped : 1 Time
 exited MaxStartups throttling after 00:03:28, 11 connections dropped : 1 Time

dictionary attacks: 772 unique usernames.

 + | 1 1111 1234 123456 1502 3 8 a aaron abc abc123 abe abhinav ada adfexc
 adm Admin admin admin01 admin08 Admin1 admin123 admin1234 Administrator
 administrator adminuser adrian ads afzal agent agotoz ahmad aiftp airflow
 alan alex ali alim alumno amalia amavisd andres anil anonymous ansible
 app appowner appserver arduino ari arkserver artem artin asag asd astra
 astro authority autumn aziz baba BACKUP backups bacon baikal bao bash
 bg binance bloom bnb botuser brs bsc btc business bvb bwa caja can car
 carlos cdp centos chain chaos charles chenhui chenzilong chrome cie
 clamav client cma cmk coder college config consultor core cs2server
 csgo curso cxj cyrusimap dal dark david db2inst1 db_user dc debian
 deepak default delegate delme deluge Demo demo deploy deposito derek dev
 developer devops diego dimas director distro divya dmp dms dns docker
 dockeruser doge dokku dolphinscheduler dominic donna dot drcomadmin dss
 dummy dvs dylan E eadmin eagle ec2-user edge edith egarcia eh ehsan
 elastic elasticsearch elena eliot ellen els emil engineer enisa eppc
 erfan eric es ester eth etherpad etq eurek examen fa fabi factory farid
 federica fedora feedback filecoin finance fluqueta flutter fmaster
 fns foo formation francesco frappe freshlogs frontend fs ftp ftp2
 ftpadmin1 ftpguest ftptest ftp_user ftpuser ftpuser01 ftpusr fwupgrade
 g1 gabriel gameserver gandalf garrysmod gaurav Gearguy geosolutions
 gestion gianluca giorgio git gnats gpadmin gray gu guest guo hacker
 hacluster hadoop hadoopuser hajar hamid hammad hanna haoran haotian hcc
 hdm hek hello hengshi hery hieu hjh hong hpc-riscv hrm hscroot hunter
 hussain hussein hwserver hxeadm hyodol i ica icp identd ik ilya incoming
 infinity info infra ingres ink install installer instrument integration
 intel ionela irina isp iwan jabber jago james jarvis jasper jayanthi jb
 jeff jenkins jerry jessica jhernandez jiaxuan jiayin jimmy Jirka jjq joao
 joe johan john joko jordan joseph joy js jt jtribino jules julien junlong
 jupyter justine k2025 kafka kapil kapsch kartika kas kaumudi kevin khan
 kibana kira kobo kocom kodi kong kp kraken kserge kt kurosawa lab landi
 lando lara lars lawrence lch leo lfs lft lido liming linda lizk lobby
 localadmin loginuser long lotus ltc luo lxy lz lzx m202 mac macro macuser
 magen mahima maill mailman maint maintain mainuser manage management
 manager mapr maribel mariusz mark marketing mass master matrix matthew
 mc mckenzie mcserver mel mgts michael middleware mike mina minecraft
 minikube misp mohammed mom mongo monica monitor mosquitto mother mpi
 mrodelo msv mt mts musicbot mycat myshake mysql mysqluser nader nadim
 nagios nancy nao NetLinx netscreen newuser nextcloud nexthink nexus
 nftp nginx nic nicole NL5xUDpV2xRa nmr nmt node nodejs nokia (none)
 noreply nuevo nutanix nw oguz okx oleh oliver olivia omm oneadmin
 onlime_r ookla opc open openproject openstack operator ops opsadmin
 opus oracle os osadmin osmc oxidized pablo pacs palserver palworld
 pam partimag paula pawel payment peace pedro peer peiyuhui peng pi
 plexuser PLMIMService polkadot pool postgres postgresql pq prachi
 pradeep pranav pre premier primenet pro prowlarr prueba pt ptcall
 publisher pvx pw qadmin qsrvbas qtss R ra rafa rahim rashid reboot
 redbot remote renato repository rescue richard rick rico rinet ripple
 riscv rizal rizzo rmsadm rob robert roger ronnie roo root1 roots roott
 RPM rsync rsyncuser rundeck runner rustserver ryan s3 sa saba saif saka
 sale sales sales1 samba samir sampsa sanket santhosh satis sbbs scanner
 school scs se sean seekcy sendmail sentry sepehr sergey serv server
 server2 setpriv setup sftp sg shamim sharan shashank sherry showroom
 shrikant sim sinusbot sipv sky skynet smb snipe so sofia software
 sol solana sonarqube sonic soporte sosemaloku sql squid ss sshadmin
 ssm sss stager stake steam steamcmd stefan store student su suha Sujan
 super superman superset supervisor support supports suraj sxf sybase SYS
 sysadm sysadmin .syslog system systemd systems sysuser t2 tabata tamara
 taylor tazos teamspeak tech technik telco telecomadmin telnet telnetd
 temp test test01 test036 test1 test10 test11 test12 test123 test2 test3
 test7 testa teste tester testserver testUser test_user testuser testuser1
 testuser2 teszt thi thomas titus tkj tokend tol tom tomcat ton training
 trouble trx ts3server ts3user ttbot tux u1 ub ubadmin ubnt ubuntu uniswap
 usabd usario usdc usdt User user user0 user06 user1 user14 user2 user3
 user36 user42 user6 user62 Username username userone usertest usr usr1
 vaibhav validator vasya vector ventas05 victor vignesh vintagestory
 vmarketing vox vpn vpnuser1 vyos wafer wangj wangjia wangli wangtao
 web WebAdmin webapp webmaster weishibo whz william wilson windowserver
 wireguard wist wizard wjm wjx won work world wpyan wqadmin wtl wwUser
 www wwww wxg xbmc xbox xgridagent xgridcontroller xlchen xrp xuchi xue
 xuqi xwang xyx yamamoto yang yangfan yangjw yhchen yinshishu yousef
 youssef yuli yuriy yusuf yutian yx yxsong yxw zabbix zain zaneta zdy
 zhang zhangtao zhangyi zhaomin zimbra zj zomboid zookeeper zoz zwj zxx