SSH attacker usernames

Methodology

• · Source: failed-login events on production SSH services across the ironcat fleet (2 VMs).
• · Window: rolling 30 days; the list reflects what attackers tried recently, not historical totals.
• · Floor: usernames with < 3 attempts are dropped — one-off typos and noise.
• · Cap: top 250 by total attempts, sorted attempts-desc then distinct-IPs-desc as the tiebreaker.
• · Filter: usernames sourced exclusively from known research-crawler or internal-infrastructure IPs are excluded.