freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Saturday June 7, 2025

denied by configuration:

 14.103.108.225: 20 Times
 14.103.114.172: 5 Times
 14.103.118.150: 24 Times
 14.103.151.61: 24 Times
 27.112.79.127 (ip27-112-79-127.cloudhost.web.id): 23 Times
 36.111.68.170: 7 Times
 39.129.9.180: 21 Times
 45.84.107.198 (exit-01.tor.r0cket.net): 1 Time
 51.77.246.7 (ns3139592.ip-51-77-246.eu): 5 Times
 58.42.204.29: 1 Time
 60.190.239.92: 7 Times
 63.41.9.206 (host206.sub-63-41-9.myvzw.com): 23 Times
 65.49.1.129 (scan-68-07.shadowserver.org): 1 Time
 80.94.95.15: 37 Times
 80.94.95.112: 34 Times
 90.189.164.20: 24 Times
 95.79.112.59 (95x79x112x59.static-business.nn.ertelecom.ru): 23 Times
 103.23.199.49 (ip103-23-199-49.cloudhost.web.id): 13 Times
 103.69.196.133 (133.196.69.103.adnshost.com): 23 Times
 103.76.120.90: 8 Times
 103.91.136.18: 10 Times
 103.176.20.115: 20 Times
 103.189.234.253 (ip103-189-234-253.cloudhost.web.id): 22 Times
 103.189.235.176 (ip103-189-235-176.cloudhost.web.id): 24 Times
 106.12.153.108: 3 Times
 111.31.14.77: 6 Times
 116.8.109.79: 16 Times
 116.110.23.90: 4 Times
 116.110.79.121: 2 Times
 116.110.87.249: 5 Times
 116.110.123.138: 4 Times
 117.48.157.75: 1 Time
 118.193.39.127: 22 Times
 120.48.98.125: 4 Times
 121.2.72.105 (p024869.kngwff01.ap.so-net.ne.jp): 9 Times
 123.253.22.7: 22 Times
 125.91.33.72: 6 Times
 134.199.169.60: 1 Time
 134.209.152.88: 1 Time
 134.209.157.89: 22 Times
 150.136.76.116: 189 Times
 154.90.50.55: 10 Times
 154.209.4.61: 1 Time
 159.65.133.180: 9 Times
 170.64.142.85: 1 Time
 170.83.79.28 (170-83-79-28.galanet.com.ve): 25 Times
 171.110.222.213: 1 Time
 171.244.134.21: 5 Times
 172.105.102.42 (dev3.academyforinternetresearch.org): 1 Time
 175.178.75.72: 7 Times
 176.57.33.193 (176-57-33-193.as16211.net): 24 Times
 176.65.148.10 (hosted-by.pfcloud.io): 1 Time
 179.51.153.37 (ip-179-51-153-37.eunapolis.netcentertelecom.net.br): 22 Times
 180.76.228.201: 1 Time
 180.184.62.111: 2 Times
 185.216.116.71: 23 Times
 185.220.101.108 (tor-exit-108.digitalcourage.de): 1 Time
 185.235.146.29: 1 Time
 188.166.237.19: 23 Times
 190.129.79.42: 22 Times
 192.227.248.232 (192-227-248-232-host.colocrossing.com): 3 Times
 193.32.162.157: 5 Times
 196.251.88.103: 1 Time
 197.199.224.52 (host-197.199.224.52.etisalat.com.eg): 12 Times
 198.24.79.245 (syn-198-024-079-245.biz.spectrum.com): 3 Times
 200.115.229.73 (cpe-200-115-229-73.telecentro-reversos.com.ar): 23 Times
 203.205.37.233 (static.cmcti.vn): 4 Times
 209.38.90.135: 5 Times
 209.126.9.204 (vmi666230.contaboserver.net): 14 Times
 218.21.230.174: 4 Times
 218.78.51.90: 4 Times
 223.130.11.165: 1 Time

system login attempted:

 bin : 2 Times
 daemon : 1 Time
 games : 2 Times
 mail : 3 Times
 man : 1 Time
 root : 582 Times
 sync : 1 Time
 sys : 1 Time

received disconnect:

 Bye Bye [preauth] : 940 Times
 Bye [preauth] : 76 Times
 Disconnected from invalid user  80.94.95.15 port 4867 [preauth] : 1 Time
 drop connection #10 from [104.244.77.50]:33124 past MaxStartups : 1 Time
 drop connection #10 from [172.2.40.233]:40084 past MaxStartups : 1 Time
 drop connection #10 from [172.2.40.233]:40872 past MaxStartups : 1 Time
 drop connection #10 from [172.2.40.233]:41054 past MaxStartups : 1 Time
 drop connection #10 from [172.2.40.233]:48204 past MaxStartups : 1 Time
 drop connection #10 from [172.2.40.233]:48589 past MaxStartups : 1 Time
 drop connection #11 from [104.244.77.50]:33138 past MaxStartups : 1 Time
 drop connection #11 from [104.244.77.50]:33158 past MaxStartups : 1 Time
 drop connection #11 from [122.156.167.62]:4020 past MaxStartups : 1 Time
 drop connection #11 from [172.2.40.233]:46284 past MaxStartups : 1 Time
 error: Protocol major versions differ: 2 vs. 1 : 2 Times
 error: beginning MaxStartups throttling : 3 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 3 Times
 error: kex_exchange_identification: read: Connection reset by peer : 20 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 7 Times
 exited MaxStartups throttling after 00:00:17, 1 connections dropped : 1 Time
 exited MaxStartups throttling after 00:00:55, 5 connections dropped : 1 Time
 exited MaxStartups throttling after 00:02:34, 4 connections dropped : 1 Time

dictionary attacks: 580 unique usernames.

 ' = | 1234 12345678 abc abdelfattah abigail account acct acer actions
 activemq adam admin admin1 Administrator admins adv agnes aida aiia
 alberto alex alin alma alondra altibase aman amaya amir amministrazione
 anaconda andras andre anil ansible anton aovalle apache2 apagar
 apiserver appadmin apple Apps apps appuser arch ari ariel ark arma as
 ashlyn aso audit automation ava avinash baba backuppc baikal bailey
 base bastion bbb beehive bender bigdata bitnami bjy bkp bounce braden
 brayden buaanic builder busio butter bwadmin byp cacti cactiuser
 camryn carmen ccc cccc cehost celery centos chad changtian checkuser
 chef chen chengqian chenxingsheng chenyoumin chiaki chr2025 chris CL
 client client002 client003 client005 cloud cloudera cloudftp clouduser
 compose composeruser config controlm copia core corso couch cpanelsolr
 cpt cristina cs2 csgoserver csy customer cyn czh czw dan daniel dataiku
 david db2inst1 dbadmin dbyang de debian debug demo denis deploy deployer
 desiree dev devel developer devin devops devserver devuser dhcp dialout
 diana discord disk dnsadmin docker document dolphin donald doomdarkrp
 dsadm dspace duan dujh dummy dwayne e ec2 ec2-user ecs edwin een
 elasticsearch elsearch emcali emma emmanuel engineer enzo erfan err0r
 es es1 esunny esuser etienne eva evil explore factura faisal falcon
 fangjh fanyuanli fax fdfgv femas fivem fleek flw frank franklin frappe
 freshlogs freyna frontend ftp ftp1 ftp_id ftpmedia ftptemp ftptest
 ftp_user ftpuser fuho fuys fw fwupgrade galdanf gandalf gece gengtaijia
 george gerald gerrit gezhang gg ggg giovanni git gitlab gits gjl gnats
 godep goran grid guest gxy hadi hadoop halo hari hduser hello help
 helpdesk henry hive howard httpadmin hu huawei I2b2demodata2 ibrahim
 ident igor imissu informix infoserve inspur install int iptv it jack
 jarservice javad javier jayden jboss jeff jesse jimmy joao joe jomar
 jonathan joran jordyn joro julio jupyter justin jxhotel jyc kali kamilla
 kayla kelsey ken kendra kenyar keycloak kibana kim king kishimoto kong
 kongjy kudar laib landon laurence lee liming liminghao lindsay linkdood
 lisi liuli liyaqin loguser long lorena lpoli lrendon luis mailuser maint
 manager mani manish margot mariadb mariah mario marko mathilde matt
 mcserver memi mgeweb mhd mhlee michael michel mike miki minecraft miner
 mojia mongo msf musikbot mysql nagios naomi narcissa nasrin net newuser
 nexus nima nishant NL5xUDpV2xRa node02 (none) nova ntop nvidia ociisprd
 ociisstd odin odoo12 oe ollama omega oneadmin opc openeuler openhabian
 openkm ops oracle oratest oscar ospite ossadm otis pal pamela payments
 pedrito pepe philip phillip photo plex polycom postgres pp prashant
 printer pritchard project pwserver q qiang qinyanling qwe r rahul
 rajesh ram ramon ranger ravi rc redis renjie robin ronald root123 rooter
 rootuser runcloud russell rustserver s sabina saige sal sam sambauser
 sammy sandra sanolsylee scott sdtdserver sean secure selenium server
 server2 servercsgo sesuser sftptest share shree simon sincroniza sipv
 smbuser software solar sonar sopuser spark spectrum spring squid stack
 state steam steamcmd steve student student4 sumit sunil sunjinyi super
 superman superset support suraj sybase sysadmin sysall system systems
 teamspeak teamspeak3 tejas telecomadmin telly telnet temp tensor terese
 test tester testftp test-user testuser text tez thomas tigergraph tim
 todds tomcat6 tomcat7 tomcat8 tomcat9 training transfer ts ts3server
 ts3server1 ts3srv tt ttf ttx tyk uap uat ubadmin ubnt UBUNTU ubuntu
 ubuntu12 ubuntuserver ukschool unifi updates upload User user user001
 user02 user1 user10 user15 user2 user3 user4 user6 user9 usera userftp
 username usertest uzivatel vagrant ventas01 viktor vincent vintagestory
 virginia vitam vitamdb vncuser vpn vpn1 vpnsvc vyos wafer wangjiaxu
 wangyi watchdog webapp website webuser wisesys wms wordpress wp wuhan
 wwadmin wwwproxy x xbmc xiaofeng xq xuhao xxx yang yekta yoshinori yt
 yupei yxsong zgr zimbra zjh zmarin zs