We are looking at the auth.log file in /var/log/auth.log
.
All the login attempts were captured in a time frame of ~3 Hours.
Get all Ips from logfile.
sudo cat /var/log/auth.log | grep "Failed password" | awk -F 'from' '{print $2}' | cut -d" " -f2 > failed-login-ips.txt