root@gateway:/var/log# grep ^Jul\ 25.*illegal\ user.*211.160.170.7 messages | awk '{ printf("%s, ", $11) }'; echo
fluffy, admin, test, guest, webmaster, oracle, library, info, shell, linux, unix, webadmin, test, admin, guest, master, apache, network, word, admin, admin, admin, admin, test, test, webmaster, user, username, username, user, admin, test, danny, sharon, aron, alex, brett, mike, alan, data, www-data, http, httpd, backup, info, shop, sales, web, www, wwwrun, adam, stephen, richard, george, michael, john, david, paul, angel, pgsql, pgsql, ident, resin, mikael, mike, suva, webpop, technicom, susan, sunsun, sunny, steven, ssh, search, sara, robert, richard, postmaster, party, michael, amanda, rpm, sgi, Aaliyah, Aaron, Aba, Abel, Jewel, users, admins, admins, Zmeu, michi, add, michael, adrian, Ionut, telnet, irc, bnc, psybnc, is, Exit, alina, andrei, stef, shell, print, get, hk, pl, Zmeu, sef, trib, haxor, hacker, max, rex, stan, bran, oper, cmd, id, nick, radu, alin, cap, sex, hy, pe, ch, za, com, org, net, internet, cafe, station, play, open, dulap, if, uk, us, alinus, rumeno, it, samba, wwwrun, ldap, squid, yahoo, postfix, mailman, kathi, at, cgi, kayten, unseen, sabin, undernet, commando, sh, bash, copy, help, flopy, nicole, send, kernel, address, not, to, password, denied, Access, cmd, char, ok, nickname, name, smecher, printul, ircop, work, pico, mcedit, edit, tgz, tar, zxvf, xvf, rk, rootkit, ferari, user, nologin, nice, bot, nothing, Where, text, passwd, angel, love, lost, leave, psy, cyborg, notice, msg, right, left, nina, file, demo, postgres, postmaster, postgres, postgres, demo, demouser, admin, admin, admin, admin, admin, admin, admin, apache, dan, electra, student, school, htt, hotdog, postgres, postgres, postgres, postgres, postgres, postgres, postgres, postgres, dragon, tomcat, tomcat4, tomcat4, tomcat, tomcat, tomcat, tomcat, tomcat, tomcat, tomcat, tomcat, fax, fax, fax, fax, fax, fax, test, test, test, test, testuser, test, test, test, test, test, sales, shop, shop, shopping, shop, sales, printer, mailman, irc, ircd, www, www-data, apache, golf, usa, musiq, helena, administrator, ROOT, router, mrtg, mrtg1, mrtg2, mrtg3, test1, test1, test123, guest, guest123, account, bank, banking, hp, ftpusr01, demo, demo, oracle, oracle, oralcle, oracle, oracle, oracle, sql, theo, rpm, rpm, rpm, rpm, rpm, goba, mailman, mailman, ntp, postgres, postfix, postfix, db, db, database, database, fax, fax, fax, fax, tester, tester, tester, tester, contact, cyrus, cyrus, cyrus, cyrus, backup, ryan, oconnor, stewart, clamav, handy, handy, ftpout, amazon, amazon, ftpin, victor, victor, dangaard, exchange, exchange, DTM, archivar, vox, 00089, reseller01, reseller01, reseller02, reseller02, test2reseller, testreseller, ebay, webchat, change, marc, marc, ingres, ingres, dbmaker, virtuoso, adam, adam, adam, pe, pe, gopher, gopher, mailnull, mailnull, rpm, rpm, xfs, xfs, xfs, ntp, ntp, ntp, rpcuser, rpcuser, rpcuser, nfsnobody, nfsnobody, nscd, nscd, nscd, ident, ident, ident, named, named, named, pcap, pcap, khan, khan, khan, rmgadmin, rmgadmin, rmgadmin, sysadmin, sysadmin, sysadmin, pub, pub, pub, admin, admin, admin, squid, squid, squid, oracle, oracle, oracle, sisap, sisap, sisap, kbjin, kbjin, kbjin, rcs, rcs, rcs, mclee77, mclee, le, le, le, wang, wang, wang, rushprint, rushprint, rushprint, sundog, sundog, sundog, jsryu, jsryu, jsryu, youmin, youmin, youmin, ocapate, ocapate, ocapate, aircode, aircode, aircode, webb, webb, webb, web, web, web, sys, sys, sys, password, password, password, player, player, player, ssh, ssh, ssh, sh, sh, sh, telnet, telnet, telnet, thomas, thomas, thomas, galladi, galladi, galladi, hierros, hierros, hierros, arcotour, arcotour, privero, privero, jose, jose, jose, hnosvega, hnosvega, hnosvega, disney, disney, disney, delgado, delgado, delgado, suarez, suarez, suarez, arcos, arcos, arcos, veyma, veyma, veyma, orlu, orlu, orlu, rajoma, rajoma, rajoma, fran, fran, fran, ssi, ssi, ssi, reciclados, reciclados, reciclados, tkip, tkip, tkip, gnome, gnome, gnome, arles, arles, arles, alba, alba, alba, squid, squid, squid, fflores, fflores, fflores, pepe_new, pepe_new, pepe_new, pepe, pepe, pepe, elo, elo, elo, yunke, yunke, yunke, vanessa, vanessa, vanessa, ternero, ternero, ternero, surtransa, surtransa, surtransa, suhian, suhian, suhian, reunion, reunion, reunion, paredes, paredes, pachon, pachon, pachon, ogazon, ogazon, ogazon, modesto, modesto, modesto, mili, mili, mili, mal, mal, mal, mago, mago, mago, loal, loal, loal, lidelsur, lidelsur, lidelsur, lamett, lamett, lamett, jorgegil, jorgegil, jorgegil, interotero, interotero, interotero, huelvasport, huelvasport, huelvasport, geiser, geiser, geiser, doblas, doblas, doblas, cal, cal, cal, barquin, barquin, asepyme, asepyme, asepyme, adame, adame, adame, postgres, postgres, postgres, postfix, postfix, postfix, hans, hans, hans, rossy, rossy, rossy, paul, paul, paul, us, us, com, com, jhon, jhon, jhon, eric, eric, eric, dexter, dexter, dexter, firewall, firewall, firewall, status, status, sbin, sbin, sbin, aircode, aircode, aircode, misc, misc, var, var, var, sysop, sysop, sysop,

(sample line: Jul 25 15:13:37 gateway sshd[29516]: Failed password for illegal user dexter from ::ffff:211.160.170.7 port 37162 ssh2 )