Oct 9 22:42:37 ns311733 sshd[14614]: input_userauth_request: invalid user jetty [preauth]
Oct 9 22:42:37 ns311733 sshd[14614]: pam_unix(sshd:auth): check pass; user unknown
Oct 9 22:42:37 ns311733 sshd[14614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.140.114.196
Oct 9 22:42:39 ns311733 sshd[14614]: Failed password for invalid user jetty from 123.140.114.196 port 38222 ssh2
Oct 9 22:42:39 ns311733 sshd[14614]: Received disconnect from 123.140.114.196 port 38222:11: Bye Bye [preauth]
Oct 9 22:42:39 ns311733 sshd[14614]: Disconnected from 123.140.114.196 port 38222 [preauth]
Oct 9 22:43:14 ns311733 sshd[14619]: Invalid user ubuntu from 159.65.41.104 port 60306
Oct 9 22:43:14 ns311733 sshd[14619]: input_userauth_request: invalid user ubuntu [preauth]
Oct 9 22:43:14 ns311733 sshd[14619]: pam_unix(sshd:auth): check pass; user unknown
Oct 9 22:43:14 ns311733 sshd[14619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.41.104
Oct 9 22:43:16 ns311733 sshd[14619]: Failed password for invalid user ubuntu from 159.65.41.104 port 60306 ssh2
Oct 9 22:43:16 ns311733 sshd[14619]: Received disconnect from 159.65.41.104 port 60306:11: Bye Bye [preauth]
Oct 9 22:43:16 ns311733 sshd[14619]: Disconnected from 159.65.41.104 port 60306 [preauth]
Oct 9 22:43:25 ns311733 sshd[14622]: Invalid user testftp from 121.134.159.21 port 56668
Oct 9 22:43:25 ns311733 sshd[14622]: input_userauth_request: invalid user testftp [preauth]
Oct 9 22:43:25 ns311733 sshd[14622]: pam_unix(sshd:auth): check pass; user unknown
Oct 9 22:43:25 ns311733 sshd[14622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.134.159.21
Oct 9 22:43:27 ns311733 sshd[14622]: Failed password for invalid user testftp from 121.134.159.21 port 56668 ssh2
Oct 9 22:43:28 ns311733 sshd[14622]: Received disconnect from 121.134.159.21 port 56668:11: Bye Bye [preauth]
I didn't know it was this easy to break into a server but Cloudbet seems to repeatedly break into the server because of how much they don't want the scams to be exposed. Every time I reinstall the entire operating system and wipe the server, they sitll break in. I'm looking at the logs now and it's wild.