freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Friday May 30, 2025

denied by configuration:

 5.78.91.55 (static.55.91.78.5.clients.your-server.de): 7 Times
 14.103.107.228: 4 Times
 14.103.117.84: 24 Times
 14.103.122.182: 6 Times
 14.103.161.189: 8 Times
 23.157.88.53 (53-88-157-23.clients.gthost.com): 26 Times
 34.150.99.166 (166.99.150.34.bc.googleusercontent.com): 24 Times
 35.216.131.34 (34.131.216.35.bc.googleusercontent.com): 1 Time
 36.158.177.46: 2 Times
 41.153.30.114: 14 Times
 45.15.227.120: 2 Times
 45.43.59.186: 19 Times
 47.103.157.194: 1 Time
 47.180.114.229 (47-180-114-229.944e76fe48b133ae6f88b784db937d44.ip.frontiernet.net): 23 Times
 51.68.126.207 (207.ip-51-68-126.eu): 9 Times
 61.80.179.118: 19 Times
 61.218.122.20 (61-218-122-20.hinet-ip.hinet.net): 2 Times
 64.62.197.151 (scan-48o.shadowserver.org): 1 Time
 64.237.132.252 (adsl-64-237-132-252.prtc.net): 19 Times
 80.94.95.15: 55 Times
 80.94.95.112: 5 Times
 84.51.43.58 (host-84-51-43-58.teletektelekom.com): 1 Time
 84.225.42.129 (netacc-gpn-5-42-129.pool.yettel.hu): 2 Times
 89.117.79.32 (vmi2576789.contaboserver.net): 22 Times
 92.118.39.61: 30 Times
 92.118.39.68: 35 Times
 101.126.90.52: 10 Times
 103.63.108.25 (static.cmcti.vn): 18 Times
 103.139.59.214: 24 Times
 103.210.21.178: 21 Times
 106.12.153.108: 3 Times
 111.30.36.61: 4 Times
 111.173.89.134: 4 Times
 112.31.254.122: 8 Times
 112.95.227.2: 1 Time
 112.184.119.22: 5 Times
 113.53.89.180 (node-hpw.pool-113-53.dynamic.nt-isp.net): 4 Times
 113.140.93.51: 2 Times
 116.50.169.141 (141.169.50.116.ids.service.static.eastern-tele.com): 1 Time
 117.33.183.172: 4 Times
 117.50.184.148: 5 Times
 118.99.80.19: 26 Times
 119.29.148.24: 2 Times
 120.48.98.125: 3 Times
 120.92.33.108: 4 Times
 125.25.45.142 (node-8zy.pool-125-25.dynamic.totinternet.net): 2 Times
 139.19.117.129 (inet-research-scan-5.mpi-inf.mpg.de): 21 Times
 140.246.92.156: 9 Times
 161.35.18.56: 1 Time
 164.90.151.202: 2 Times
 165.22.217.96: 23 Times
 167.71.240.112: 4 Times
 178.128.236.79: 3 Times
 182.44.72.96: 3 Times
 185.93.89.118: 5 Times
 185.235.16.48: 3 Times
 188.166.191.39: 17 Times
 190.129.122.86: 20 Times
 191.242.105.133: 19 Times
 192.3.105.24 (192-3-105-24-host.colocrossing.com): 23 Times
 193.24.211.22: 1 Time
 193.32.162.130: 34 Times
 193.32.162.134: 55 Times
 193.32.162.157: 5 Times
 193.77.88.253 (BSN-77-88-253.static.siol.net): 2 Times
 194.65.144.243: 23 Times
 194.182.78.105 (cerebrum.medihackers.net): 4 Times
 195.178.110.6: 201 Times
 197.5.145.121: 23 Times
 218.73.99.246: 14 Times
 218.161.90.126 (218-161-90-126.hinet-ip.hinet.net): 13 Times
 221.221.138.78: 5 Times
 222.105.2.84: 21 Times
 222.108.100.117: 23 Times

system login attempted:

 sshd : 2 Times
 daemon : 1 Time
 root : 380 Times
 www-data : 1 Time

received disconnect:

 Bye Bye [preauth] : 826 Times
 Bye [preauth] : 42 Times
 Client disconnecting normally [preauth] : 1 Time
 drop connection #10 from [140.246.92.156]:22088 past MaxStartups : 1 Time
 drop connection #10 from [222.108.100.117]:40286 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:10756 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:17256 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:38868 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:55404 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:56078 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:59346 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:63066 past MaxStartups : 1 Time
 drop connection #11 from [140.246.92.156]:64020 past MaxStartups : 1 Time
 drop connection #12 from [140.246.92.156]:63460 past MaxStartups : 1 Time
 drop connection #13 from [140.246.92.156]:31672 past MaxStartups : 1 Time
 drop connection #13 from [140.246.92.156]:52780 past MaxStartups : 1 Time
 drop connection #14 from [140.246.92.156]:21518 past MaxStartups : 1 Time
 drop connection #14 from [140.246.92.156]:29334 past MaxStartups : 1 Time
 drop connection #14 from [140.246.92.156]:48064 past MaxStartups : 1 Time
 drop connection #14 from [140.246.92.156]:56476 past MaxStartups : 1 Time
 drop connection #17 from [140.246.92.156]:59846 past MaxStartups : 1 Time
 drop connection #19 from [140.246.92.156]:50074 past MaxStartups : 1 Time
 drop connection #19 from [140.246.92.156]:58430 past MaxStartups : 1 Time
 error: Protocol major versions differ: 2 vs. 1 : 2 Times
 error: beginning MaxStartups throttling : 3 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 4 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "POST / HTTP/1.1" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "{"id": 1, "method": "mining.subscribe", "params": ["MinerName/1.0.0", "EthereumStratum/1.0.0"]}" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "{"id": 1, "method": "mining.subscribe", "params": ["cpuminer/2.5.1"]}" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "{"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"47gvasvnPjJKwvuvoQVsyZ78L4CfRvsSe5RfFwSZSLtA4PCAyutcn87Sc3WLVPFoNyeo1RBkqpVzFW9XiG5YSBzPNr2UZ36","pass":"x","agent":"XMRig/6.15.3 (Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019","algo":["cn/" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "{"id":1,"method":"eth_submitLogin","worker":"igwrcvap","params":["0xcf1172beb64869500ca504028f7ef81d7e7385f0","x"],"jsonrpc":"2.0"}" : 1 Time
 error: kex_exchange_identification: read: Connection reset by peer : 29 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 6 Times
 exited MaxStartups throttling after 00:00:08, 1 connections dropped : 1 Time
 exited MaxStartups throttling after 00:03:30, 11 connections dropped : 1 Time
 exited MaxStartups throttling after 00:03:34, 8 connections dropped : 1 Time

dictionary attacks: 471 unique usernames.

 0admin 1 1111 aaa abbey abhinav acct activemq ada adam admin admin1234
 Administrator adrian adv afa ahmad ahmed aida alejandro alex ali aluno
 amandabackup amit andrey angela anil ansadmin antonio apache appadmin
 appconnect apps arcgis arch arun askfm audit authority autumn babosh
 bailey benj binance bitcoin bittensor bitwarden blog bnb bodega bot
 botuser breanna briana bryce btc btc1 caitlin cam cameron cassandra
 castle catherine cc ccorrea celery centos charles chatbot Chicago
 christina cindy cisco class client cloud clouduser composer contact
 craft cron crypto cs2 cs2server cs2sv csgo cyrus dakota dalton dan daniel
 david db db2admin db2inst1 dbadmin ddd deamon debian degen delegate denis
 deploy dev devel develop devops discord distro django dmdba docker doge
 dogecoin dot ds dsadm dspace ecs eli emiliene emma eric eris erp esuser
 eth ether ethereum ethereumdocker eva eversec factura faith fedora
 felix fer filecoin filippo fleek frappe freshlogs freund ftp ftp_id
 ftp-user ftpuser ftpuser1 fuho gavin geo geonode gerrit gg git git5
 github gitlab gitlab-psql gmodserver grafana gts guest gwadmin gwei hack
 hadoop hammad hamza hannah hari hduser henry hpc-riscv ian identd igor
 images imran in info insight int io j jada jake james jane jason jboss
 jenkins jeremy jesse jing jj john joseph joyce jrodrig julian kafka kali
 kasun kaylee kenneth kernel kettle klas kodi kohlruss kraken ladyaspb
 laura legal leo lido lin linkdood linuxacademy local logviewer lotus
 lpoli ltc lucas mailadmin maint makayla makdil manish manoj manuel mapr
 marcus margaret maria mariah marissa mastodon mauro me media medieval
 melissa mhd michael miguel mina mindy minecraft minikube minima mirc
 mohit mongo mongod monika monitor morgan mosquitto musicbot mw mysqld
 myuser nasrin newusername nexus nginx nick nikhil nikita nima nishant
 noc node nodeuser (none) noreply nushi nvidia ob oe okx olov omar omm
 oneadmin openkm openvpn oracle oracle-test oradev osboxes ozzy p4ass0rd
 paige palworld partimag paul pc pi pierre polkadot postgres pratik prod
 pruebas psg public qwerty r radarr radio rafael rainer ram rancher raul
 readonly recepcion renee reporting retag reza rf rich richard riscv rob
 robert root2 rootadmin roy runner sahil saslauth sc Server seyoung share
 shelby shiny shubham sipv sistema sol solana sonarqube spencer staging
 stake steam stephen steve storage sunil super superset support switch
 sybase sysop taibabi tanner task tazos teamsystem telegram telegramapi
 telkom tempuser test test01 test123 test5 testing test-user testuser
 thomas tk tmpuser toiawase tomcat tomcat10 tomcat7 trade-bot trade.bot
 tradebot training trinity trx ts3server tuan u1 uap ubnt ubuntu ubuntu1
 ubuntuserver uddalok uniswap unix uno85 unocasa usdc usdpuser usdt
 User user user02 user1 user2 user8 user9 user-backup userftp username1
 usuario1 usuario2 vagrant valheim vali validate validator ventas05
 victor viper vision vncuser VPN vpn vpn1 vps vscabo vsftpd vyos waski
 web web3 webapp webuser weewx wialon william wireguard wow www wwwsh
 X305-unix xbox xg xrp xxx yang ygarcia ymoreno yoyo yusuf z zgr zh
 zhangsan zhongwen zhou zimbra zjh zjw zoe zxcloudsetup