I looked in /var/log/auth.log and found a number of entires I didn't like. Here's a list of IP addresses I saw.
Block [101.43.159.25]
Block [117.15.151.211]
Block [119.3.215.48]
Block [121.4.171.88]
Block [124.222.22.95]
Block [171.236.185.100]
Block [178.254.28.68]
Block [200.159.243.141]
Block [210.245.84.18]
Block [34.91.116.19]
Block [36.93.83.5]
Block [46.101.17.53]
Block [54.180.104.198]
Office Automation, n.:
The use of computers to improve efficiency in the office
by removing anyone you would want to talk with over coffee.
Block [101.43.159.25]
Block [117.15.151.211]
Block [119.3.215.48]
Block [121.4.171.88]
Block [124.222.22.95]
Block [171.236.185.100]
Block [178.254.28.68]
Block [200.159.243.141]
Block [210.245.84.18]
Block [34.91.116.19]
Block [36.93.83.5]
Block [46.101.17.53]
Block [54.180.104.198]
Office Automation, n.:
The use of computers to improve efficiency in the office
by removing anyone you would want to talk with over coffee.