freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Tuesday June 3, 2025

denied by configuration:

 1.31.14.6: 1 Time
 14.103.107.93: 11 Times
 14.103.112.1: 4 Times
 14.103.170.162: 5 Times
 14.103.243.142: 3 Times
 27.96.84.210 (ezecom.27.96.84.0.210.ezecom.com.kh): 16 Times
 34.76.2.67 (67.2.76.34.bc.googleusercontent.com): 12 Times
 34.101.205.204 (204.205.101.34.bc.googleusercontent.com): 26 Times
 36.67.70.198 (sehati.tanjabtimkab.go.id): 4 Times
 38.43.76.234: 24 Times
 46.101.210.71: 5 Times
 51.77.246.7 (ns3139592.ip-51-77-246.eu): 1 Time
 58.18.98.76: 1 Time
 58.18.100.5: 4 Times
 58.56.23.210: 7 Times
 60.31.147.37: 1 Time
 64.62.197.140 (scan-48d.shadowserver.org): 1 Time
 77.68.116.210 (moodle.adleriansocietywales.org.uk): 4 Times
 80.94.95.15: 43 Times
 80.94.95.112: 28 Times
 80.94.95.115: 4 Times
 80.94.95.116: 10 Times
 86.127.247.88 (86-127-247-88.digimobil.es): 2 Times
 89.44.137.176: 24 Times
 92.118.39.68: 36 Times
 98.80.4.20 (ec2-98-80-4-20.compute-1.amazonaws.com): 1 Time
 101.126.55.63: 5 Times
 101.126.89.144: 14 Times
 103.183.75.218 (ip103-183-75-218.cloudhost.web.id): 20 Times
 106.12.153.108: 4 Times
 115.124.77.186 (dipa.co.id): 1 Time
 116.110.17.14: 5 Times
 116.110.18.60: 3 Times
 116.253.213.64: 5 Times
 117.50.67.183: 5 Times
 119.160.193.12: 1 Time
 120.48.98.125: 3 Times
 120.240.153.98: 1 Time
 123.124.132.50: 3 Times
 125.25.45.142 (node-8zy.pool-125-25.dynamic.totinternet.net): 2 Times
 143.202.210.210 (143-202-210-210.neo.com.py): 26 Times
 159.203.93.39: 15 Times
 161.230.93.200 (200.93.230.161.rev.vodafone.pt): 1 Time
 163.5.148.15: 3 Times
 170.64.134.113: 1 Time
 172.105.102.10 (prod08.academyforinternetresearch.org): 1 Time
 172.174.72.225: 25 Times
 176.94.185.62: 26 Times
 185.156.73.233: 7 Times
 185.156.73.234: 7 Times
 186.117.149.128: 8 Times
 193.32.162.130: 20 Times
 193.32.162.157: 5 Times
 195.178.110.6: 58 Times
 211.253.10.96: 13 Times
 218.21.230.174: 1 Time

system login attempted:

 sshd : 2 Times
 backup : 1 Time
 bin : 1 Time
 daemon : 1 Time
 nobody : 1 Time
 root : 300 Times
 www-data : 2 Times

received disconnect:

 Bye Bye [preauth] : 497 Times
 Bye [preauth] : 77 Times
 Normal Shutdown, Thank you for playing [preauth] : 4 Times
 error: Protocol major versions differ: 2 vs. 1 : 2 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 3 Times
 error: kex_exchange_identification: read: Connection reset by peer : 19 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 7 Times

dictionary attacks: 300 unique usernames.

 1111 12345 a aarrestad abey ada adm admin admin1 administrator aj alan
 alec alexis american amir amit ana andres anonymous api app artem asdf
 aso av avinash aws azure backend base bitcoin bitrix bittensor blog
 bnb bot3 bounce btc burrero carter cassandra cdr centos chang chat
 chatbot chris chrism cindy clayton cloudftp comp config controlm copia
 corey cortega cristian crystal dark data db dbadmin dd default deploy
 deployer dev developer devops devuser dhcp django dmdba dockeradmin doge
 dolphinscheduler dot ds dustin emgts erpnext erpuser erwin eth etienne
 fastuser fernando filecoin Flower fran frappe freshlogs ftp_user ftpuser
 gitlab-psql gits gl going grafana guest hadoop hanna hassan helmuth henry
 installer ismail ivan j jaden javier jeff jessica jett jim jira johnathan
 jonas jonathan josh jrodriguez justin k8s kate khalid kiara kiosk kk
 koha kong librenms lidia lihui lillian lisi lorena lotus lsk magdalena
 magento manish manuel mark maurice mckenzie meghan mgeweb minh minima
 mininet mm monitoring moth3r mqm mtvps1 mysql nagios nami newusername
 nikhil nikolay node nodeuser (none) noreply odoo odoo13 oipqi olivier
 openeuler openvpn operator oracle patrol peak pedrito pgadmin pi plexuser
 posiflex postgres press professional proxyuser prueba publico python pz
 r00t reporting riley robin rocketmq roger root1 root11 root2 rooter RPM
 rstudio runcloud ruoyi rust ryan s sa sales salim samp sandbox sandeep
 sandra saude scott seekcy service sftp sftpuser shin sim skylar smooch
 sol solana solar sonar splunk sql squid ss sshadmin steam steam1 steven
 student student5 superadmin superv suporte support system t128 teamspeak
 telecomadmin telegram temp test teste theo tigergraph tin titan ts ts1
 uat ubnt ubuntu umair uno85 usdc usdt User user user5 user9 userftp
 username usher usuario vali validator vbox ventas05 vinay vip viper
 vnc vncuser vpn vpnuser vtatis vyos webapp webapps weewx whmcs wilson
 wireguard work wow wp wqmarlduiqkmgs www xd xq xrp xyh zgr