freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Tuesday June 17, 2025

denied by configuration:

 14.55.144.22: 29 Times
 14.103.50.32: 14 Times
 14.103.73.80: 3 Times
 14.103.115.156: 4 Times
 14.103.133.104: 9 Times
 34.87.39.167 (167.39.87.34.bc.googleusercontent.com): 28 Times
 36.41.186.5: 15 Times
 45.135.193.67: 5 Times
 45.135.232.92: 12 Times
 45.148.10.240: 12 Times
 45.178.181.92: 16 Times
 46.101.158.40: 45 Times
 52.183.95.195: 27 Times
 64.62.156.129 (scan-80-7.shadowserver.org): 1 Time
 64.227.174.243: 7 Times
 78.128.112.74 (ip-112-74.4vendeta.com): 8 Times
 80.94.95.15: 26 Times
 80.94.95.112: 33 Times
 87.243.7.118 (87.243.7.118.primetelecom.ro): 5 Times
 92.118.39.95: 20 Times
 92.222.10.43 (vps-d17ac08c.vps.ovh.net): 26 Times
 103.29.85.13 (ssd2.professionalwebsolutions.com.au): 26 Times
 103.117.56.120 (ip103-117-56-120.cloudhost.web.id): 23 Times
 103.189.234.85 (syn-103-189-234-085.res.spectrum.com): 23 Times
 106.12.151.247: 22 Times
 115.21.126.188: 3 Times
 115.246.222.92: 2 Times
 116.98.172.118 (dynamic-ip-adsl.viettel.vn): 5 Times
 116.110.13.61: 4 Times
 116.110.87.58: 3 Times
 116.110.88.65: 3 Times
 116.110.123.97: 3 Times
 117.33.140.60: 25 Times
 118.26.39.187: 16 Times
 120.48.2.63: 23 Times
 120.48.98.125: 6 Times
 122.176.122.24 (abts-north-static-024.122.176.122.airtelbroadband.in): 27 Times
 137.116.238.160: 22 Times
 161.35.21.48 (movecenter-movecenter.eu): 22 Times
 170.64.178.254: 1 Time
 172.105.18.94 (172-105-18-94.ip.linodeusercontent.com): 1 Time
 173.188.14.11 (h11.14.188.173.dynamic.ip.windstream.net): 2 Times
 175.126.111.34: 1 Time
 176.9.163.50 (static.50.163.9.176.clients.your-server.de): 3 Times
 176.65.148.55 (hosted-by.pfcloud.io): 2 Times
 178.113.155.145 (178.113.155.145.wireless.dyn.drei.com): 1 Time
 180.184.141.117: 11 Times
 181.47.161.200 (cpe-181-47-161-200.telecentro-reversos.com.ar): 33 Times
 181.115.171.95: 6 Times
 181.116.220.11: 8 Times
 181.116.220.12: 3 Times
 182.253.156.184: 27 Times
 185.93.89.118: 5 Times
 186.96.151.198 (fixed-186-96-151-198.totalplay.net): 21 Times
 187.51.208.158 (187-51-208-158.customer.tdatabrasil.net.br): 20 Times
 187.137.198.19 (dsl-187-137-198-19-dyn.prod-infinitum.com.mx): 4 Times
 188.0.130.250 (250.130.0.188.static.ktc.kz): 27 Times
 193.24.211.22: 1 Time
 193.32.162.141: 35 Times
 193.32.162.157: 5 Times
 194.206.84.231 (c2ce54e7.fsp.oleane.fr): 3 Times
 195.88.120.62 (195-88-120-62.parustelecom.ru): 1 Time
 196.0.120.211 (xen2.utclonline.co.ug): 24 Times
 204.44.127.231: 7 Times
 209.38.81.49: 2 Times
 209.38.233.74: 25 Times
 210.101.91.153: 7 Times
 217.156.22.214: 1 Time
 221.182.17.234: 1 Time

system login attempted:

 backup : 1 Time
 root : 321 Times

received disconnect:

 Bye Bye [preauth] : 790 Times
 Bye [preauth] : 60 Times
 Client disconnecting normally [preauth] : 1 Time
 error: Protocol major versions differ: 2 vs. 1 : 3 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "" : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 3 Times
 error: kex_exchange_identification: read: Connection reset by peer : 22 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 5 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 5 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 5 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 5 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 5 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 5 Times

dictionary attacks: 579 unique usernames.

 aaaa aadhya aakanksha aarav abc abhi abigail acer aditya Admin admin
 admin1 admin1234 admin2 administrator adminsys adrian ahmed alexander
 alexandre ali alice alina almalinux aluno amelia amir amrita ananya
 anas anastasia andrea andrei andrew anil anna annie ansible anton
 api applmgr appuser arav arjun arnav arturo asim asterisk astra
 aurora austin autcom autrede av ayaan Azure azureuser baba backuppc
 bash bastion bayu benjamin bianca bitnami bitrix bitwarden blog bob
 book boris bot bot3 botuser bounce bravo brenna brian btf builduser
 bwadmin ca cacti caja01 carlotta carol caroline carolyn cassandra cat
 celery celeryuser charles chatbot chloe choi chrism christopher clara
 cloud composer composeruser config copia corbin cortega crafty crm cs2
 csgoserver damon dana daniel danny dara david davide db2inst1 dbadmin
 deamon deamon_root deandre deanna debian deepak dell denis dennis deploy
 deployment deposito desliga dev dev1 developer devops devuser diana
 diogo diquest dmdba dmitry doadmin docker dockeruser dolphinscheduler
 dong dspace ec2-user ecs eddie edge edubook egarcia ekp elasticsearch
 elasticuser elemental elena eli emilia emily emma eric erp es esuser
 eth ethereum evan evelyn explore exx factorio factory family fastuser
 fatima felipe filippo finance fish fleek foundry frank frappe frappe-user
 freddie freshlogs frontend ftp ftpadmin ftp_id ftptest ftpupload ftp-user
 ftp_user ftpuser ftpuser1 ftpusers gabriel gaia gaurav geo gerrit ghost
 ghostcms ghostuser giorgio giovanni git gitlab-runner gits giulia gl
 gleb goga gokul grace greg grid guest hadoop hamed hamza hari harper
 hasan hdfs hossein hostinger howard hpc-riscv hruser ibrahim imani
 in info informix installer int intell intern ionadmin it jack jan
 jane janusz javad jenkins jessica jimmy jito jj joe john jonathan jose
 julia jupiter jupyter kafka kailey kali kbe keycloak khalid kian kibana
 kim kiran koha kp kris kristin kristopher lane laravel lch ld lee leo
 liliana lisi liyang ljsoft localadmin lola lucas luciano luis maarch
 mahdi mailuser main maks mapr marc marco marisa maroof martin master
 mc mcadmin media mega mehdi mel mgeweb mhd michael miguel mike milad
 mina minecraft minikube minima mk mohsen monitor moxa mt mukund myles
 mysql mythtv nabi nam nas nasrin nathan nc newtest newuser nextcloud
 nginx nia nima njzf NL5xUDpV2xRa nlp node (none) nutanix odoo odoo15
 olivier ollama oneadmin opc openbravo openhabian ops oracle orange
 oriol osama osmc ossuser pablo palworld panel partimag pascal patrol
 pavel pc pedro peertube pentest perforce perla pgadmin pi picorv plex
 plugin pool postgres pratik pre prueba psg public pwserver pz rafael
 rahul rajeev rajesh ram ravi readarr redmine reporting riad ricky riscv
 rke roberto robin rocky roo roott rose runcloud ruoyi rustserver s1
 saeed sales1 sam sambauser sanjay saul sc scsadmin sean sebas security
 sepehr server server1 sftp sftptest sftpuser shayla shiva shoaib shree
 sina singh sistema smart smb sms sol solana solv sonar sonarr soporte
 speedtest splunk spotlight spring sql squid ssh stack steam steamcmd
 storage strapi sumit sunil superset supervisor suporte support switch
 syncuser synology sysadmin system t t128 taibabi taiga team1 teamcity
 teamspeak techuser tejas telecomadmin temp tempuser terraria Test test
 test1 test12 test5 test9 tester testftp testing testproxy tests testuser
 theta tibero tidb tim tmax tmp tom tomcat1 tommy ton ts1 ts2 ts3 tst
 tucker tunnel tv ubnt ubuntu updates user user01 user02 user03 user-1
 user_1 user1 user10 user12 user123 user2 user3 user4 user-backup userftp
 userlogin username usertest usuario2 utils vagrant validator var vinay
 vishal vor vpn vps vpsuser vr vyos web webadmin webapp webuser wiki
 william winter wms wordpress work worker world wow wqadmin wuhan www
 x xiangyu xxx yekta youssef yuizt yuxiang yy z zc zh zimbra zjh zmarin
 znc znc-admin zone zy zyx