A spray and a brute force in one log
Two addresses failed logins on sso-gw in the same ten minutes. One hammered one account; the other tried one password on many. Tell them apart and count the accounts sprayed.
Briefing
A brute force tries many passwords against one account. A password spray tries one or two common passwords against many accounts, slowly, to stay under lockout thresholds.
Both show up as "Failed password for <user> from <ip>" in auth.log. In these lines the username is field 9 and the address is field 11.
sso-gw · SSH brute force
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.