freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Saturday June 14, 2025

denied by configuration:

 14.103.90.30: 1 Time
 14.103.151.61: 7 Times
 14.103.161.186: 14 Times
 23.94.194.126 (23-94-194-126-host.colocrossing.com): 23 Times
 35.208.68.245 (245.68.208.35.bc.googleusercontent.com): 24 Times
 36.46.129.70: 9 Times
 45.135.232.92: 18 Times
 45.232.73.84: 23 Times
 46.101.99.155: 109 Times
 47.74.51.79: 1 Time
 49.119.102.78: 21 Times
 49.232.172.253: 23 Times
 52.183.128.237: 22 Times
 58.124.223.20: 4 Times
 61.188.205.76 (76.205.188.61.broad.nj.sc.dynamic.163data.com.cn): 2 Times
 64.62.156.170 (scan-84-8.shadowserver.org): 1 Time
 72.50.80.206 (adsl-72-50-80-206.prtc.net): 24 Times
 80.94.95.15: 43 Times
 80.94.95.112: 12 Times
 80.94.95.115: 10 Times
 80.94.95.116: 11 Times
 88.79.75.206 (intern.vito.ag): 22 Times
 101.43.12.185: 3 Times
 101.126.92.215: 25 Times
 103.106.229.68: 3 Times
 103.117.57.201 (ip103-117-57-201.cloudhost.web.id): 26 Times
 103.181.143.10: 20 Times
 116.98.175.77 (dynamic-ip-adsl.viettel.vn): 4 Times
 116.110.93.63: 3 Times
 120.48.98.125: 4 Times
 122.156.167.62: 15 Times
 123.58.213.127: 23 Times
 124.44.117.106 (g106.124-44-117.ppp.wakwak.ne.jp): 4 Times
 136.35.133.152 (136-35-133-152.googlefiber.net): 2 Times
 139.59.34.255: 19 Times
 143.198.113.194: 6 Times
 159.89.43.101: 12 Times
 170.64.173.208: 1 Time
 170.84.79.105 (170.84.79.105.umplaytelecom.com.br): 1 Time
 177.85.247.230: 9 Times
 177.157.204.82 (177.157.204.82.dynamic.adsl.gvt.net.br): 5 Times
 182.215.66.232: 2 Times
 185.156.73.233: 14 Times
 185.156.73.234: 11 Times
 185.216.116.99: 23 Times
 186.56.11.17: 30 Times
 191.242.105.131: 24 Times
 192.227.247.92 (bigdatahospit11h.objetomartelo.sbs): 23 Times
 193.32.162.141: 35 Times
 193.32.162.143: 32 Times
 193.32.162.157: 5 Times
 194.0.234.19: 9 Times
 194.0.234.93: 2 Times
 195.165.181.16 (mobile-user-c3a5b5-16.dhcp.inet.fi): 5 Times
 201.131.212.19: 25 Times
 203.57.70.121: 2 Times
 210.79.142.221: 21 Times
 221.151.84.79: 2 Times
 223.197.248.209 (223-197-248-209.static.imsbiz.com): 23 Times

system login attempted:

 sshd : 2 Times
 bin : 2 Times
 daemon : 1 Time
 nobody : 1 Time
 root : 310 Times
 www-data : 2 Times

received disconnect:

 Bye Bye [preauth] : 704 Times
 Bye [preauth] : 55 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 5 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "GET /favicon.ico HTTP/1.1" : 1 Time
 error: kex_exchange_identification: read: Connection reset by peer : 20 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 7 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 7 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 7 Times

dictionary attacks: 518 unique usernames.

 1111 1234 12345 aave abc access acct acs actions ada ada1 adm ADMIN
 Admin admin admin1 admin123 admin1234 admin5 adminftp Administrator
 administrator admins ak alex alexis alin alireza allnodes almacen
 amine ampal anaconda andreas andres andrey andy angel anonymous ansible
 anthony anton apache ari arun asdf asim aso astra autcom av avalanche
 avax Azure azure azureuser backups bad baran barman base bch be beehive
 ben bg bitcoin bnb bob bodega book bot bounce brandon brenda brock
 bryson btc btc1 builder builduser ca caja01 cardano carlos carolina
 cat cc ccorrea cdr cgpexpert chat chatbot chris cindy cisco clamav
 clouduser cmsuser code coin comp composer config connect core cortega
 crm crypto cryptoexpert curtis cyril dangulo dao DAppNode dappnode
 dasusr1 db2fenc1 dbuser dd ddd debian debianuser default degen delegate
 demo demo1 deploy deployer deployment depot development diego dimas
 diquest dmdba dogecoin dominique donald drake dspace dummy ec2-user
 eigen eli ella erc20 erp ERPNext erpuser es esearch esunny eth ether
 Ethereum ethereum ethereumdocker etienne expensive fatima fedora fil
 filecoin forum forward frank frappe free freshlogs ftp ftp1 ftp_user
 ftpuser fuho fw gabriel gameserver geo gg ghost git gitlab-runner
 grafana grid guest gwei hadoop haha halo hamed hammad haylee hduser
 hello henry hlw hpc-riscv hrm hugo ibrahim installer intell ionguest
 iot ismail jaime james jarservice java jay jayla jenkins jerry jessica
 jim jinhan jira jj jonas jonathan jose josh justin k8s kali kamera
 kameron kernel kirsten kodi koha lab lance lihui linkdood linux lite
 litecoin litenode litnode log loguser lorena lotus lsk ltc luciano
 luna m maarch magdalena maint makerdao mamad manager manish mapadmin
 mapr marco mario mark maroof mcadmin media metasfresh metricbeat mina
 minablockchain minecraft miner minh mininet miningpool mohammad mohsen
 mongod monitoring morgan moth3r mrodelo myappuser mysql myuser nadia
 neko nemo new newusername nikhil nikita nino node nodemanager nodeuser
 (none) nrk nutanix ocean ociistst odoo odoo13 ofbiz omar one oneadmin
 openvpn operator ops oracle oxidized panda panel partimag patrol paul
 payara pgsql pi picorv Polkadot polkadot pool pop postgres prakash pratik
 prod production prometheus prowlarr PRUEBA prueba pruebas publico puser
 q qwerty rahul rajesh ram raul report rigo ripple riscv rizki roberto
 rocketpool roman root11 rooter RPM rstudio ruby runcloud runner ryan
 saas sahil sales sammy sandra sanjay santana scam scan seafile sean
 seekcy sendmail sepehr server service seyoung sftptest sftpuser shib
 shin shoaib sidney sim simon sinusbot sistemas smart sms sol solana
 solv sonar sonarqube sonus squid sshadmin sshuser stakebnb stakeeth
 stakepool steam steam1 steven Sujan super superv support sushi svnserver
 syncthing syncuser sysadmin system taiga teamspeak telecomadmin telegram
 telegramapi temp term2 tessa test test001 test01 test1 test2 test3 test4
 test6 testadmin teste testmail testtest test-user testuser testwww titan
 titus tmp token tomcat toor tori toto trade-bot trade.bot tradebot tron
 ts ts1 ts3 ts3server tt ubnt ubuntu uniswap updates user user001 user1
 user10 user12 user15 user3 user5 user7 userftp username usman usuario
 usuario1 validate validator var vector vendas vinay vip vishnu vlad VM
 vor vpn vpnuser vps vr vtiger vyatta vyos wang web web3 webapp website
 webuser wialon william wilson windows withdraw work workflow wuhan www
 wxg x xiangyu xq xrp xtest xuhao yy zabbix zhang zjh zomboid zone zs