Out of curiosity one day I started grabbing from my devices / servers logs the login attempts that were made.

From there I made a list of the IPs that tried to log in the most, and the user that was used.

I made a nice map that you can see on the repo - and feel free to suggest a use / improvement - or to contribute with your logs too (just the IPs and users, not your original logs files - see the README).

Cheers.

I've had a similar script running for a good two years to submit data to AbuseIP. I'll look around for some of the old logs and submit them when I get some time.