Brute force password attacks on Linux over SSH

This is one of the main reasons I hate running SSH on the standard port numbers, every day I get log-alerts like these. As per usual I notify the originating ISP, at least I have an email template for it.
Failed logins from these:
invalid user abdul (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user abort (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user abs (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user adam (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user admin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user admin (password) from 203.98.XXX.XXX: 14 Time(s)
invalid user advertise (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user alan (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user alcatel (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user alex (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user alex (password) from 203.98.XXX.XXX: 6 Time(s)
invalid user allan (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user aloha (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user alpha (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user alter (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user ameno (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user amman (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user andy (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user angel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user antidot (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user apache (password) from 125.240.XXX.XXX: 30 Time(s)
invalid user apache (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ariane (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aron (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user art (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user artificial (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user asahi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aspect (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aspidistra (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user atempt (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user atilla (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user atom (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user aurel (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user avsadmin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user azazel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user backup (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user base (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bash (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user beast (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user berg (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user beta (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user binary (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user black (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bobo (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bogdan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user book (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user bourn (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user brett (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user brian (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user buche (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cable (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cache (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cain (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cambera (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user camelia (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cesna (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user chat (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user chris (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user church (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user clark (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user client (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user coffee (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user common (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user costel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user costi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user crack (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user cristina (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user cyclon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dalton (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user danny (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user darling (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dasilva (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user data (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dave (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user david (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user david (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user davod (password) from 125.240.XXX.XXX: 2 Time(s)
invalid user deserve (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user desire (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dns (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user domain (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user donna (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user dool (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user down (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dragon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user dudu (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user earth (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user elixir (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user elvis (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user epsilon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user eric (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user example (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fadeh (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fatih (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fax (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user felix (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user fiat (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user filter (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user finale (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user fire (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user foon (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user ford (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user found (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user frank (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user freddy (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user ftpuser (password) from 125.240.XXX.XXX: 30 Time(s)
invalid user gamma (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ganja (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user gaspar (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user george (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user gerhard (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ghost (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user gone (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user grand (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user granicus (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user gregory (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user grims (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user guest (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user guest (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user gushi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user hang (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user hassan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user health (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user helen (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user hell (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user helmut (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user heracle (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user honour (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user host (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user http (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user httpd (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user iarin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ident (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user include (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user info (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user info (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user iolanda (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user ion (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user ionut (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user irina (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jack (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user jamal (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user james (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jasmina (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jason (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user java (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jeffrey (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jelem (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jenny (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jerry (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jessica (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user jessie (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user jhony (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user jiang (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jihad (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user jim (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user joe (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user john (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user john (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user jupiter (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user just (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user justice (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user justin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user kadir (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kain (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kaleb (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kelly (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user kevin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user kevin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kline (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user koln (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user kondor (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lampard (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user larry (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user laura (password) from 125.240.XXX.XXX: 16 Time(s)
invalid user laura (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user law (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lawyer (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user leroi (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user leslie (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user lex (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user library (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user library (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user light (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lincoln (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user linda (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user linux (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lisa (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user locco (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user lost (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user louis (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user louise (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user lucky (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mailtest (password) from 125.240.XXX.XXX: 24 Time(s)
invalid user malaga (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mano (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user maria (password) from 203.98.XXX.XXX: 6 Time(s)
invalid user mariana (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mark (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mark (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user marte (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user marty (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user mary (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user master (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user matt (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user media (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mercur (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mercury (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user michael (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mike (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mike (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user mind (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user minerva (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mister (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mistero (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mobifon (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user mohamed (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mona (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user monaco (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user monica (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mooka (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user moon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mount (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mrdev (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mumu (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user munis (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user mysql (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user mysql (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user nancy (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user neptun (password) from 203.98.XXX.XXX: 3 Time(s)
invalid user nino (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user noise (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user nokia (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user office (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user okubo (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user omega (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user oracle (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user oracle (password) from 203.98.XXX.XXX: 10 Time(s)
invalid user oracle1 (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user osama (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user osiris (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user osman (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user palm (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user panama (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user pascal (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user patricia (password) from 125.240.XXX.XXX: 12 Time(s)
invalid user patrick (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user paul (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user paul (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user peter (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user pgsql (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user port (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user portal (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user postfix (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user postgres (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user public (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user quarter (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user rajev (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user read (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user rehash (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user relay (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user remove (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user rename (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user repection (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user request (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user resin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user restore (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user richard (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user richard (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user road (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user robert (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user robin (password) from 125.240.XXX.XXX: 14 Time(s)
invalid user roger (password) from 125.240.XXX.XXX: 18 Time(s)
invalid user sales (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user sales (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user sam (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user samba (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user same (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sandy (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user sarah (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user saturn (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user scott (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user script (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user search (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user send (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user serafim (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user server (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user service (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user shadow (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shake (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sharon (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user sharon (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shell (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shoot (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shop (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user shrike (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sigmund (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user siliciu (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user silla (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user silva (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user silvia (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sirg (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user smash (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user smell (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user smuf (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user snake (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sole (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sombrero (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sorina (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sound (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user space (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sparc (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user spool (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sport (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user squad (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user staff (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stanley (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user start (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stealth (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user steel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stepfen (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stephen (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user steve (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user steven (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user stick (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user storm (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user stream (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user student (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user student (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user sun (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user support (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user support (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user susan (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user susan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user system (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user target (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tay (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user temp (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user temp (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tener (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user test (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user test (password) from 203.98.XXX.XXX: 14 Time(s)
invalid user testuser (password) from 125.240.XXX.XXX: 26 Time(s)
invalid user tetra (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user thanatos (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user thoor (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tony (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user tony (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user torpe (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user track (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user travel (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user tristan (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user truth (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user unix (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user user (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user user (password) from 203.98.XXX.XXX: 16 Time(s)
invalid user username (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user venus (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user verset (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user video (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user vincent (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user virtual (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user vision (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user visual (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user warez (password) from 203.98.XXX.XXX: 1 Time(s)
invalid user web (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user webadmin (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user webadmin (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user webmaster (password) from 125.240.XXX.XXX: 28 Time(s)
invalid user webmaster (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user while (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user white (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user william (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user willy (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user wish (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user write (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user www (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user www-data (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user wwwrun (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user yarrow (password) from 203.98.XXX.XXX: 2 Time(s)
invalid user zed (password) from 203.98.XXX.XXX: 4 Time(s)
invalid user zoom (password) from 203.98.XXX.XXX: 2 Time(s)
root/password from 125.240.XXX.XXX: 30 Time(s)
root/password from 203.98.XXX.XXX: 36 Time(s)

Locked account login attempts:
apache : 32 Time(s)
mysql : 30 Time(s)
postfix : 26 Time(s)

However, my favourite ones are still the bots that try talking HTTP to my SMTP server:
unknown[61.128.XXX.XXX] sent non-SMTP command: POST / HTTP/1.1 : 1 Time(s)

4 thoughts on “Brute force password attacks on Linux over SSH”

  1. Not sure where I found this, but I added these rules to my iptables configuration. It limits the number of access attempts to an ssh port. If an ip address connects more than 3 times they are locked out for 600 seconds. Mostly eliminated hacker attacks on my ssh port.
    # rate-limit ssh traffic
    iptables -I INPUT -p tcp –dport 22 -i eth1 -m state –state NEW -m recent –set
    iptables -I INPUT -p tcp –dport 22 -i eth1 -m state –state NEW -m recent –update –seconds 600 –hitcount 4 -j DROP

  2. Interesting…
    I take it you don’t use SCP/SFTP often then?
    Surely transferring lots of files over SFTP with some clients will cause more than N connections and hence get ya blocked?

  3. Actually, I use SCP all the time. Never have a problem with it, but usually tgz all the files prior to transfer. The SSH protocol may only make the initial connection to port 22 and then transfer to other ports for the additional connections – IIRC that’s the way standard FTP works.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top