I worked at a place that had a lot of baremetal machines on the open internet.

I would occasionally scan the auth.log to see which users the bots were using and it was an interesting mix of:

- service accounts e.g. mysql, admin, etc

- individual names e.g. tom, ankit, alexei etc