#!/usr/bin/env python3
import sqlite3, datetime

DB = "sshd_failures.db"

db = sqlite3.connect(DB)

for ip, count, last_ts in db.execute("""
    SELECT ip, COUNT(*), MAX(ts)
    FROM failures
    GROUP BY ip
    ORDER BY COUNT(*) DESC
"""):
    last = datetime.datetime.fromtimestamp(last_ts)
    print(f"{ip:40} {count:5}  last={last}")

db.close()