I have a Pi 1 on my local network hooked up to 44net (the ARDC's public access internet via Wireguard). The following is the count of top failed ssh login attempts for each username over about a 3 day period. Attacks started immediately.
143 ec2-user
144 ftpuser
152 nginx
155 ftp
217 debian
218 centos
254 pi
348 solv
381 hadoop
390 git
446 mysql
607 guest
723 ubuntu
782 postgres
863 oracle
880 test
1468 user
2648 admin
