What is the attacker trying to tell me?

To me it looks a bit like the attacker has a few stereotypes to satisfy by his attack on my server (which is located in Germany, although I’m located in Iceland :mrgreen: ).

Jul 22 00:09:08 fafnir sshd[12408]: ... invalid user deutch
Jul 22 00:09:10 fafnir sshd[12410]: ... invalid user german
Jul 22 00:09:13 fafnir sshd[12412]: ... invalid user hitler
Jul 22 00:09:16 fafnir sshd[12414]: ... invalid user deutchland
[...]
Jul 22 19:20:26 fafnir sshd[18676]: ... invalid user deutch
Jul 22 19:20:28 fafnir sshd[18678]: ... invalid user german
Jul 22 19:20:31 fafnir sshd[18680]: ... invalid user hitler
Jul 22 19:20:33 fafnir sshd[18682]: ... invalid user deutchland
[...]
Jul 23 17:47:12 fafnir sshd[31315]: ... invalid user deutch
Jul 23 17:47:16 fafnir sshd[31317]: ... invalid user german
Jul 23 17:47:19 fafnir sshd[31319]: ... invalid user hitler
Jul 23 17:47:23 fafnir sshd[31321]: ... invalid user deutchland
[...]

BTW: it’s “deutsch”, not “deutch” (which probably is a borrowed and bastardized form of the English “Dutch” which is indeed related to the former). 😉

// Oliver

This entry was posted in /dev/null. Bookmark the permalink.

2 Responses to What is the attacker trying to tell me?

  1. mathias says:

    hitler is the default username for german servers, isn’t it? 😆 Sorry, it was just a joke.

  2. Oliver says:

    Yes, it’s the naming scheme for servers and users on any German system.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.