freshlogs is the concept
see https://www.freshlogs.ca/fl-ToS-Disclaimer.html
Use https://freshlogs.ca/index.txt for complete long lines.
Use https://freshlogs.ca/prev-index.d/ for previous posts.

Thanks to those hard workers with debian.org, fail2ban.org, logwatch.org
and countless others for quick stats right out of the box.  Added a
quick list of unique usernames from dictionary attacks.

Friday June 20, 2025

denied by configuration:

 5.135.194.230 (exclicanet.net): 27 Times
 8.134.159.4: 1 Time
 14.215.120.90: 3 Times
 36.104.147.6: 23 Times
 38.43.93.252 (38.43.93.252.hostodo.com): 22 Times
 40.76.229.77: 22 Times
 44.220.188.92 (ec2-44-220-188-92.compute-1.amazonaws.com): 1 Time
 45.135.232.92: 9 Times
 45.168.176.34: 3 Times
 48.216.209.247: 26 Times
 64.227.123.64: 18 Times
 65.49.1.200 (scan-75-08.shadowserver.org): 1 Time
 78.89.156.91: 18 Times
 80.94.95.15: 34 Times
 80.94.95.112: 31 Times
 92.118.39.92: 26 Times
 92.205.228.135 (135.228.205.92.host.secureserver.net): 25 Times
 94.125.187.114: 4 Times
 101.133.235.172: 1 Time
 103.49.239.163 (ip103-49-239-163.cloudhost.web.id): 24 Times
 103.61.123.132: 27 Times
 103.82.21.8: 24 Times
 103.98.176.164: 23 Times
 103.159.206.45: 22 Times
 103.212.211.151 (ip-211-151.cirebonkab.go.id): 23 Times
 103.215.81.209: 3 Times
 104.199.151.189 (189.151.199.104.bc.googleusercontent.com): 22 Times
 105.72.172.250: 22 Times
 113.105.100.5: 5 Times
 115.151.72.153: 22 Times
 116.110.82.138: 3 Times
 116.110.84.22: 5 Times
 116.110.85.237: 3 Times
 116.110.87.199: 5 Times
 116.110.94.105: 4 Times
 116.110.211.142: 4 Times
 117.72.121.188: 5 Times
 120.48.56.8: 10 Times
 120.48.98.125: 2 Times
 120.78.181.111: 1 Time
 122.156.167.62: 4 Times
 125.25.32.105 (node-6eh.pool-125-25.dynamic.totinternet.net): 5 Times
 128.199.33.46: 5 Times
 128.199.250.152: 27 Times
 135.13.12.81: 4 Times
 139.59.226.77: 1 Time
 140.246.137.102: 23 Times
 141.98.155.18 (vmi2653905.contaboserver.net): 3 Times
 143.198.16.19: 22 Times
 145.239.144.125 (ns31711626.ip-145-239-144.eu): 4 Times
 147.182.247.236 (ubuntu-24.04-nexus-erp): 52 Times
 150.223.72.92: 23 Times
 152.32.185.214: 29 Times
 161.35.184.65: 27 Times
 170.205.71.172 (172.71.205.170.static.wline.lns.sme.cust.swisscom.ch): 4 Times
 171.251.29.107 (dynamic-ip-adsl.viettel.vn): 3 Times
 175.139.176.213: 21 Times
 176.65.148.10 (hosted-by.pfcloud.io): 1 Time
 176.65.148.55 (hosted-by.pfcloud.io): 4 Times
 178.128.198.235: 24 Times
 180.76.105.165: 5 Times
 186.31.95.163 (static-186-31-95-163.static.etb.net.co): 23 Times
 187.212.35.121 (dsl-187-212-35-121-dyn.prod-infinitum.com.mx): 52 Times
 189.7.17.61 (bd07113d.virtua.com.br): 8 Times
 190.228.95.181 (181.95.228.190.telecom.com.ar): 19 Times
 198.24.79.245 (syn-198-024-079-245.biz.spectrum.com): 3 Times
 198.55.98.176 (unassigned.quadranet.com): 21 Times
 204.44.127.231: 5 Times
 209.38.26.13: 1 Time

system login attempted:

 backup : 1 Time
 daemon : 1 Time
 root : 402 Times
 www-data : 1 Time

received disconnect:

 Bye Bye [preauth] : 977 Times
 Bye [preauth] : 82 Times
 error: Protocol major versions differ: 2 vs. 1 : 1 Time
 error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" : 1 Time
 error: kex_exchange_identification: read: Connection reset by peer : 29 Times
 error: kex_protocol_error: type 20 seq 2 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 4 [preauth] : 6 Times
 error: kex_protocol_error: type 20 seq 6 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 3 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 5 [preauth] : 6 Times
 error: kex_protocol_error: type 30 seq 7 [preauth] : 6 Times

dictionary attacks: 499 unique usernames.

 1 123456 aaa abc access activemq adam admian admin admin1 admin1234
 admin2 administrator airflow aj ajay alex ali alice alireza allinone aman
 amir amit andrey anil ansible anthony anton aovalle apagar applmgr apps
 appuser arcgis ardi arma artem arthur asad ashish ashleigh ashok astra
 auditor aziz azureuser barman bastion baylee bbb beehive ben bitcoin
 bitnami bitrix bkp bob bodega boom bot botuser brent brian bryant btc
 build builduser ca carol castle ccorrea cdr celery centos cgpexpert
 chat cheeki cindy cisco ciuser client clock cmm comp config consulta
 core cristina crm cs2server cs2srv csgoserver csserver cubrid cuser dan
 david db2admin db2inst1 dbuser dc ddd deamon debian deepak deja delegate
 demo denis deploy deployer deployment devel developer devops devuser
 diego django dockeruser dogecoin dolphin drcomadmin dspace egarcia ekp
 elastic elena emilee eoffice eprints eric es eslbackup es_user esuser
 eth ether ethereum ethereumdocker etienne eversec fa factura family
 farm fatemeh fedora felipe felix fileuser fleek frappe frappe-user
 free freshlogs ftp ftp1 ftp-user ftpuser ftpuser3 g gabriel gateway geo
 geonode george georgia gg git gitea github gmodserver grayson guest gwei
 hadoop hammad hari hassan headscale heaven hengshi herman home hostinger
 import incoming info infopad informix installer intern j jackett jackie
 jeff jellyfin jenkins jim jimmy jira joe john jrodrig julia jupiter
 justin k8s kafka kali kamryn karim khan kingbase kiosk kiran kodi kube
 kubeadmin lander lc leo lfc lisa liu loginuser logviewer lorenzo louis
 lrendon lsk luo maint manager mani manoj marco marek maria martin marvin
 mary master mastodon mcuser me media mehdi miladmim mina minecraft mj
 mk mm mohammad monique morteza mqm mtcl musicbot mysql nabi nagios nas
 nasrin nb nc newadmin newftpuser newuser nexus nikolay nishant nisuser
 noc node (none) ociisstd odin odoo odoo13 odoo17 oe office oguz onkar
 opc openbravo operator opsadmin oracle osama ossadm oxidized pablo
 palserver panel patrick paul pb pedrito pgadmin pick piyush polkadot
 postfix postgres postgresql precio01 prometheus prowlarr proxyuser
 proxyuser1 PRUEBA prueba psg ptuser publico pujie pzuser rancher raquel
 readarr readonly red redmine remnux reza2 rich robin rock roman root1
 root2 roots RPM rtc ruoyi rush rustserver ruth ryan sa sai said salim sam
 samba sample-user sampsa sandeep sangoma saude scott sdbadmin sdtdserver
 secret secure security sepehr seyoung sftp_user shin shiny showroom sim
 sinusbot sistema sistemas site soap sol solana sonar sonarqube soporte
 speedtest squid sshuser steam stefano steve strapi strycek student
 student3 student5 super superadmin superv support syncthing sysadmin
 t128 tacuser tan teamspeak3 techuser temp teresa term2 terraria test
 test01 test1 test123 test2 test3 test4 test5 tester testtest test-user
 test_user testuser testuser1 thai theo theodore tidb tigergraph tkadmin
 tom tomcat tony trade-bot trade.bot tradebot ts ts1 ts3 ts3server ttx
 tunnel ty u1 ubnt ubuntu ubuntu2 user user001 user002 user03 user1
 user10 user100 user123 user13 user14 user3 userlogin userroot usman
 utente uzivatel vagrant validate validator vbox vboxuser ventas01 video
 vinay vlad VPN vpn vpntest vtatis vyatta vyos wan wcs web web3 webadmin
 webapp website wiki william wms wpuser wuhan www x xt xx yangy yaraque
 yassine ymoreno yogesh youssef yuna yupei yusuf zh zimbra zookeeper