SSH Failed Login Analyzer
A Python tool that reads a Linux auth log and reports which IP addresses keep failing to log in over SSH.
It scans auth.log for "Failed password" lines, pulls the IPv4 address out of each one with a regex, and counts attempts per address so the noisiest sources sit at the top. Standard library only, split into small read, count, and report functions with clear handling for a missing or unreadable file. I built it because triaging auth logs is the kind of work a junior analyst actually does, and I wanted to do it by hand before reaching for a bigger tool.