Comment by encom

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month.

  # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30
     5190 #redacted: my domain name
     3063 admin
     1891 #redacted: another domain name
      931 user
      724 ubuntu
      287 test
      268 solv
      206 odoo15
      200 solana
      197 sol
      184 ubnt
      173 wialon
      170 Antminer
      169 guest
      168 odoo17
      159 oracle
      157 postgres
      151 git
      150 support
      142 ftp
      135 ftpuser
      120 debian
      118 pi
       91 nginx
       85 baikal
       82 docker
       81 perl
       74 operator
       74 deploy
       72 dev