freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Saturday May 31, 2025

denied by configuration:

 1.55.188.190: 1 Time
 14.63.196.175: 4 Times
 14.103.115.210: 22 Times
 14.103.118.150: 26 Times
 14.103.127.83: 7 Times
 14.103.127.198: 2 Times
 14.103.170.146: 1 Time
 23.157.88.53 (53-88-157-23.clients.gthost.com): 4 Times
 34.75.26.147 (147.26.75.34.bc.googleusercontent.com): 22 Times
 36.111.68.170: 5 Times
 36.133.109.48: 5 Times
 36.158.177.46: 2 Times
 37.148.206.165 (165.206.148.37.host.secureserver.net): 22 Times
 39.156.156.153: 8 Times
 43.154.195.142: 4 Times
 45.92.177.249: 4 Times
 45.163.1.222: 26 Times
 45.192.103.18: 23 Times
 49.119.102.78: 5 Times
 50.114.203.222 (50-114-203-222.ips.acedatacenter.com): 3 Times
 59.19.182.197: 5 Times
 64.62.156.214 (scan-89-2.shadowserver.org): 1 Time
 64.226.103.63: 4 Times
 67.71.54.12 (bras-base-toroon6126w-grc-05-67-71-54-12.dsl.bell.ca): 23 Times
 68.251.141.114 (adsl-68-251-141-114.dsl.covlil.ameritech.net): 25 Times
 80.94.95.15: 17 Times
 85.18.236.229 (85-18-236-229.ip.fastwebnet.it): 22 Times
 88.142.46.185 (185.46.142.88.rev.sfr.net): 26 Times
 92.118.39.57: 5 Times
 92.222.180.245 (vps-97c3c829.vps.ovh.net): 22 Times
 101.126.30.240: 8 Times
 101.133.235.172: 1 Time
 102.23.122.235: 23 Times
 103.23.199.128 (ip103-23-199-128.cloudhost.web.id): 22 Times
 103.149.26.160: 22 Times
 103.170.4.19: 22 Times
 103.181.143.99: 14 Times
 103.226.139.21 (idcloud1.vlavano.live): 25 Times
 106.12.153.108: 4 Times
 106.75.162.123 (fsm5nftz.cn): 19 Times
 111.53.87.28: 4 Times
 113.140.93.51: 2 Times
 115.240.221.28: 20 Times
 116.203.51.59 (static.59.51.203.116.clients.your-server.de): 26 Times
 118.70.178.158: 3 Times
 120.48.98.125: 5 Times
 121.18.88.74 (hebei.18.121.in-addr.arpa): 2 Times
 125.94.71.207: 2 Times
 134.209.157.89: 7 Times
 138.197.96.181: 4 Times
 139.19.117.129 (inet-research-scan-5.mpi-inf.mpg.de): 20 Times
 147.28.184.4: 4 Times
 150.139.201.247: 20 Times
 152.32.191.75: 3 Times
 159.89.190.96: 8 Times
 162.243.168.76: 23 Times
 163.172.50.15 (163-172-50-15.rev.poneytelecom.eu): 22 Times
 163.172.98.52 (163-172-98-52.rev.poneytelecom.eu): 25 Times
 164.132.7.54 (ip54.ip-164-132-7.eu): 22 Times
 165.232.70.106: 1 Time
 165.232.161.174: 4 Times
 170.83.79.28 (170-83-79-28.galanet.com.ve): 19 Times
 170.83.79.29 (170-83-79-29.galanet.com.ve): 1 Time
 170.83.79.30 (170-83-79-30.galanet.com.ve): 1 Time
 172.105.102.10 (prod08.academyforinternetresearch.org): 1 Time
 178.91.96.182 (178.91.96.182.dynamic.telecom.kz): 4 Times
 181.115.208.36: 1 Time
 182.44.72.96: 3 Times
 182.61.25.91: 18 Times
 185.93.89.118: 5 Times
 185.255.91.39 (static.39.91.255.185.clients.irandns.com): 25 Times
 186.225.219.18 (186-225-219-018.fastnet.net.br): 4 Times
 187.16.96.250 (mvx-187-16-96-250.mundivox.com): 25 Times
 189.3.191.89: 25 Times
 193.32.162.137: 31 Times
 194.182.78.105 (cerebrum.medihackers.net): 3 Times
 194.187.179.253: 1 Time
 195.178.110.6: 83 Times
 195.179.227.224 (vmi2621610.contaboserver.net): 8 Times
 196.188.248.33: 10 Times
 197.156.85.73: 11 Times
 202.39.251.216 (202-39-251-216.hinet-ip.hinet.net): 4 Times
 203.25.208.110: 11 Times
 203.34.48.182: 20 Times
 203.151.136.150: 4 Times
 209.38.233.74: 25 Times
 209.126.9.204 (vmi666230.contaboserver.net): 22 Times
 210.101.91.155: 25 Times
 217.154.126.209 (ip217.154.126-209.pbiaas.com): 4 Times
 217.154.229.138 (ip217.154.229-138.pbiaas.com): 4 Times
 218.78.51.90: 2 Times
 218.161.90.126 (218-161-90-126.hinet-ip.hinet.net): 11 Times
 222.222.220.108 (108.220.222.222.broad.sj.he.dynamic.163data.com.cn): 1 Time
 222.255.115.237 (static.vnpt.vn): 25 Times
 223.17.0.181 (181-0-17-223-on-nets.com): 3 Times
 223.244.25.6: 2 Times

system login attempted:

 bin : 1 Time
 root : 477 Times

received disconnect:

 Bye Bye [preauth] : 1281 Times
 Bye [preauth] : 38 Times
 drop connection #10 from [80.94.95.15]:42001 past MaxStartups : 1 Time
 drop connection #11 from [111.67.199.209]:53762 past MaxStartups : 1 Time
 drop connection #11 from [111.67.199.209]:53788 past MaxStartups : 1 Time
 drop connection #12 from [111.67.199.209]:35280 past MaxStartups : 1 Time
 drop connection #12 from [111.67.199.209]:38040 past MaxStartups : 1 Time
 drop connection #12 from [172.105.102.10]:47670 past MaxStartups : 1 Time
 drop connection #12 from [182.44.72.96]:41898 past MaxStartups : 1 Time
 drop connection #13 from [111.67.199.209]:47548 past MaxStartups : 1 Time
 drop connection #13 from [111.67.199.209]:51408 past MaxStartups : 1 Time
 drop connection #13 from [111.67.199.209]:55118 past MaxStartups : 1 Time
 drop connection #13 from [111.67.199.209]:56250 past MaxStartups : 1 Time
 drop connection #13 from [172.105.102.10]:47588 past MaxStartups : 1 Time
 drop connection #13 from [182.44.72.96]:35056 past MaxStartups : 1 Time
 drop connection #13 from [182.44.72.96]:48272 past MaxStartups : 1 Time
 drop connection #13 from [195.178.110.6]:48598 past MaxStartups : 1 Time
 drop connection #14 from [103.181.143.99]:45318 past MaxStartups : 1 Time
 drop connection #14 from [111.67.199.209]:42632 past MaxStartups : 1 Time
 drop connection #15 from [182.44.72.96]:37084 past MaxStartups : 1 Time
 drop connection #15 from [182.44.72.96]:45220 past MaxStartups : 1 Time
 drop connection #15 from [182.44.72.96]:52864 past MaxStartups : 1 Time
 drop connection #15 from [182.44.72.96]:58086 past MaxStartups : 1 Time
 drop connection #17 from [182.44.72.96]:45026 past MaxStartups : 1 Time
 error: Protocol major versions differ: 2 vs. 1 : 1 Time
 error: beginning MaxStartups throttling : 2 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 2 Times
 error: kex_exchange_identification: read: Connection reset by peer : 19 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 7 Times
 exited MaxStartups throttling after 00:02:47, 12 connections dropped : 1 Time
 exited MaxStartups throttling after 00:05:57, 10 connections dropped : 1 Time

dictionary attacks: 464 unique usernames.

 123 Aappo abc abdelk account acer achkar acs adam admin admin123
 administrator adv aguacate ahmad airflow ak alberto alex alexa alice
 alma almacen aman amber andras andres andy angel arcgis ark arma3 as
 ashley asterisk aws backend badsha bastion bbb beate ben bender block
 bong brenda builder builduser bungeecord cacti caja camile carrie
 casaos cassandra castle celery celeryuser centos chat cheeki chris
 chrism christina cindy cinema claire cloud clouduser code confluence
 crack craft cs2server cs2srv csgo csgoserver csserver customer dataiku
 db2admin db2inst1 dbuser dc dci debian deep demo demo1 deploy des
 desarrollo dev develop developer developer1 devops diego dima django
 dls dolphin donald dorothee douglas dsodb ecs eduardo edubook ekp
 elastic elsearch enric esuser ewtho exx factorio felipe filecoin
 filippo flyadmin frank freelancer freshlogs ftp ftptest ftp-user
 ftpuser ftpuser1 ftpuser2 g gabriel gbasedbt geo gerald gino giorgio
 git git2 github gitlab gitlab-runner gits gncdr going grace greg greger
 hadi hadoop hanna haoran haotian hdoop hh hiveos hugo ibrahim icecast
 import ims informix infoserve intel intern io ionadmin iptv Iqadmin
 jackett jackson janet jason jay jb jeff jing jira jj johnson jorge
 jorgen julian julien julio jupiter kapsch karim kathryn keda kerstin
 kettle kim kiran kitchen kp kubelet lap laura ld licongcong light lin
 liwei llido loginuser long lotus louis lsk luca magento maggie maint
 manager mandried manuel mariadb marine max mc mcserver mega min minecraft
 minecraftserver misha mj mohsen mongo mongod mongodb2 monitor mosquitto
 mrodelo mw mysql mythtv myuser nagios nehas newuser neww nexus nginx
 nick nikita NL5xUDpV2xRa nlp nmr node nodeuser (none) noreply nvidia
 odoo olivier omar omega onfroy openeuler openhabian oracle oraprod
 osama osboxes oscar ossadm owner ozzy pal palworld panda panel pavel pc
 pi pivpn polycom postgres postgresql prashant p@ssw0rd public python q
 qbtuser quentin r r00t ram raul rc readarr recepcion redis redmine resin
 rich rizki rke robin roman roo root2 rootadmin rose rust s1 sa sabina
 sahil sales samba sambauser sammy sandeep sara sc sean secure secured
 selinaxin sfserver shane share shin shubham shuihaw sistemas smb sol
 solana solr spark splunk ss stack staging steam steve strapi student1
 student2 student5 Sujan sun superadmin supervisor support suraj svn
 sybase syncthing sysadmin sysroot system systems t128 taiga taiko tan
 teamspeak3bot123 tech telnet temp template terrariaserver test test001
 test01 test1 test123 test6 teste tester testing testmail testuser tg
 tim tin tinkerware tiptop titan tk tmp tomcat tommy tony track ts2 ts3
 ts3bot ubnt ubuntu ubuntuserver umair uno85 updates upload user user02
 user1 user10 user11 user13 user2 user5 user6 user7 usman usr usuario2
 uupc valheim validator vastbase ventas05 vhost victor villadc vishnu
 visitor VM vpn vpsuser vscode vtatis wafer walter web web2 webapps
 weblogic web-user webuser werkstatt windows wireguard wordpress work
 workflow x xd xdp xq xt xtest xx yanghao yogesh ypwang yucel yue yxsong
 zbodycontr zc zeus zhangwei znc zs zstack zxl