What is the attacker trying to tell me?

To me it looks a bit like the attacker has a few stereotypes to satisfy by his attack on my server (which is located in Germany, although I’m located in Iceland ).

Jul 22 00:09:08 fafnir sshd[12408]: ... invalid user deutch
Jul 22 00:09:10 fafnir sshd[12410]: ... invalid user german
Jul 22 00:09:13 fafnir sshd[12412]: ... invalid user hitler
Jul 22 00:09:16 fafnir sshd[12414]: ... invalid user deutchland
[...]
Jul 22 19:20:26 fafnir sshd[18676]: ... invalid user deutch
Jul 22 19:20:28 fafnir sshd[18678]: ... invalid user german
Jul 22 19:20:31 fafnir sshd[18680]: ... invalid user hitler
Jul 22 19:20:33 fafnir sshd[18682]: ... invalid user deutchland
[...]
Jul 23 17:47:12 fafnir sshd[31315]: ... invalid user deutch
Jul 23 17:47:16 fafnir sshd[31317]: ... invalid user german
Jul 23 17:47:19 fafnir sshd[31319]: ... invalid user hitler
Jul 23 17:47:23 fafnir sshd[31321]: ... invalid user deutchland
[...]

BTW: it’s “deutsch”, not “deutch” (which probably is a borrowed and bastardized form of the English “Dutch” which is indeed related to the former). 😉

// Oliver