SSH Brute Force: Name the Source

An SSH service was hammered overnight. /var/log/auth.log is full of 'Failed password' lines — most from ordinary typos, but ONE source IP dwarfs the rest: the brute-forcer.

Find the single IP with the most failed-login attempts and record it (just the IP, on its own line; the top line of a uniq -c count is accepted too) to /root/case/bruteforce_ip.txt.

Grading checks the recorded IP, so the ranking has to be right — not just any IP that appears in the log.