SSHD logs an entry in wtmp file even when login is denied with /etc/nologin file. As a result last command shows entries even for denied logins.
close bugs that were resolved in OpenSSH 8.5 release cycle