freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Wednesday June 18, 2025

denied by configuration:

 8.221.139.48: 1 Time
 14.103.112.114: 18 Times
 14.103.116.87: 1 Time
 14.103.170.139: 4 Times
 20.54.64.50: 21 Times
 27.254.235.3: 2 Times
 36.41.186.5: 6 Times
 36.88.35.211: 1 Time
 36.134.138.153: 9 Times
 36.137.38.119: 1 Time
 41.59.82.183 (183.82-59-41.static-zone.ttcldata.net): 1 Time
 45.55.137.170 (jobscheduler.pranical.com): 21 Times
 45.88.91.4: 1 Time
 45.135.232.92: 15 Times
 47.74.51.79: 1 Time
 47.84.69.4: 1 Time
 51.75.124.228 (vps-edcbbc9b.vps.ovh.net): 22 Times
 52.183.95.195: 2 Times
 58.209.234.84: 5 Times
 65.49.1.174 (scan-73-02.shadowserver.org): 1 Time
 79.137.36.161 (161.ip-79-137-36.eu): 18 Times
 80.94.95.15: 22 Times
 80.94.95.112: 35 Times
 87.121.112.107: 28 Times
 88.79.75.206 (mail.vito.ag): 17 Times
 92.118.39.95: 3 Times
 93.123.109.115: 4 Times
 95.79.112.59 (95x79x112x59.static-business.nn.ertelecom.ru): 9 Times
 103.67.78.132 (ip103-67-78-132.cloudhost.web.id): 23 Times
 103.92.84.50: 20 Times
 103.151.239.51: 15 Times
 103.154.77.2 (dns.77.2.t2net.id): 22 Times
 103.186.1.131 (ip103-186-1-131.cloudhost.web.id): 19 Times
 103.189.234.85 (syn-103-189-234-085.res.spectrum.com): 1 Time
 103.244.232.110: 4 Times
 111.119.199.45 (ecs-111-119-199-45.compute.hwclouds-dns.com): 2 Times
 112.165.211.123: 25 Times
 115.21.126.188: 2 Times
 115.140.161.61: 3 Times
 115.160.146.86: 19 Times
 117.9.171.3 (dns3.online.tj.cn): 19 Times
 120.48.98.125: 6 Times
 128.199.95.60: 28 Times
 137.184.91.50: 24 Times
 150.223.20.12: 9 Times
 152.32.250.188: 2 Times
 154.38.182.82 (vmi2572247.contaboserver.net): 24 Times
 165.154.172.232: 21 Times
 170.64.139.24: 1 Time
 170.64.156.156: 1 Time
 170.64.190.188: 1 Time
 170.64.195.47: 3 Times
 170.64.196.244: 2 Times
 170.64.199.14: 2 Times
 170.64.207.154: 1 Time
 170.64.211.36: 1 Time
 172.105.102.42 (dev3.academyforinternetresearch.org): 1 Time
 176.57.33.193 (176-57-33-193.as16211.net): 21 Times
 176.65.148.55 (hosted-by.pfcloud.io): 1 Time
 178.62.17.84 (ubuntu20.4-bader-rider): 28 Times
 180.76.105.165: 12 Times
 181.188.159.138 (SCZ-181-188-159-00138.tigo.bo): 8 Times
 185.93.89.118: 5 Times
 186.121.205.29 (static-186-121-205-29.acelerate.net): 8 Times
 193.24.211.22: 1 Time
 193.32.162.146: 14 Times
 193.32.162.157: 5 Times
 198.23.174.113 (198-23-174-113-host.colocrossing.com): 21 Times
 204.44.127.231: 4 Times
 211.253.10.96: 23 Times
 212.83.130.207 (212-83-130-207.rev.poneytelecom.eu): 25 Times
 216.9.224.66 (static-216-9-224-66.whitelabelservices.us): 21 Times
 217.154.212.24 (ip217.154.212-24.pbiaas.com): 1 Time
 220.181.77.166: 3 Times

system login attempted:

 nobody : 1 Time
 root : 331 Times
 www-data : 1 Time

received disconnect:

 Bye Bye [preauth] : 851 Times
 Bye [preauth] : 64 Times
 Client disconnecting normally [preauth] : 1 Time
 Disconnected from invalid user  80.94.95.15 port 6514 [preauth] : 1 Time
 error: Protocol major versions differ: 2 vs. 1 : 2 Times
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 2 Times
 error: kex_exchange_identification: read: Connection reset by peer : 29 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 6 Times

dictionary attacks: 448 unique usernames.

 1 1234 a aaa abc abhinav access acct acs actions activemq aditya Admin
 admin admin123 adminftp administrador admins afa aida aj ajay alaina
 alexis alfredo alfresco ali alice alin alina almalinux alumno aman
 amssys anaconda anas andreas andrey andy angelo anon ansible antonio
 aovalle apollo appadmin appuser apt arcgis ark art1 arthur asdf ashish
 ashlee aso asterisk automation azureuser b backend backuppc backupuser
 baran base bash be bender best bg bitrix bitwarden bkp bob boda book bot
 brandon builder builduser ca caja centos cgpexpert chatbot chrism cisco
 clock cmm coder composeruser consulta crm cs2server cuser d daniel darren
 dat db db2inst1 debian debianuser demo dev dev1 devops devtest diquest
 dls dmdba dockeradmin drcomadmin dspace dummy ec2-user epadmin erp es
 es1 es_user esuser eversec fedora filippo %first5% %first6% %first7%
 %first8% fivem flectra frank frappe-user freshlogs ftp ftptest ftpuser
 ftpuser1 fuho fusion gautam gg ghostcms git gitlab gmodserver gmq gns3
 going gokul grafana greg grid guest gzbtz hadi haha hamed hammad hari
 hdoop hello hossein hu hugo icecast idempiere iman infoserve insight
 intel ionadmin ionguest ismail itadmin jake janusz jarrett jarservice
 jay jb jeff jenkins jimmy jj john jose joy k kali kamera kashan kassidy
 keycloak kim kiran kodi kris kyt lab leidyroa leo librenms lighthouse
 lihui linkdood liu logan loguser lol lorena luna luo m mailuser main
 maint maks mamy manager mani manish marco mark marketing marvin master mc
 mcserver me mehdi metabase mf mhd micheal mike minecraft ming minikube
 mininet monitor morgan mostafa mp mtcl mtvps1 musicbot mw mysql mysqld
 myuser nami nasrin newuser newusername nexus nikita nlp node nodeuser
 (none) ntuser nvidia ociistst odoo odoo12 omar omm onkar opc openeuler
 openhabian opsadmin oracle pablo palworld patrick payroll pc pepe
 peter pg pi pool pos postgres pp prakash pratik printer prowlarr PRUEBA
 publico radarr radio rancher reelftptv report reza rigo rke rocky root123
 root2 rooter roots rosa rtc runcloud runner rustserver s1 sabina saeed
 salavat samp samson satis sc scsadmin sdtdserver sean sebas server
 share shin shiny showroom simon sina sinusbot sipv smart smbuser snq
 soheil sol solana solar solv sonar soporte splunk stack staging station
 status steam steam1 steven stperez strapi super superadmin suporte
 support suraj svn switch syncthing syncuser sysadmin tabitha taiga
 tejas telecomadmin telkom terraria tes Test test test1 test2 teste1
 tester testing testmail testtest testuser theo tibero tmp tony trade
 trung ts ts1 ts3server tunnel tv ubnt ubuntu uftp unknown user user01
 user1 user10 user2 useradmin userftp user_jenkins username usher usman
 usuario1 usuario2 utente uzivatel validator vbox ventas victor vincent
 vivek vlad vpn vscode vyatta wang wcs web weblogic webuser wendy wfp
 wg wiki winter wj work wso2 www X305-unix xd xq xxx ygarcia ypwang yy
 zabbix zcm zhang zion zomboid zone zte zyx