I looked in /var/log/auth.log and found a number of entires I didn't like. Here's a list of IP addresses I saw.
Block [101.42.161.122]
Block [119.240.188.148]
Block [129.152.11.208]
Block [191.195.158.73]
Block [194.32.123.67]
Block [27.50.88.75]
Block [34.132.42.210]
Block [43.129.246.75]
Block [43.138.50.80]
Block [43.143.82.193]
Block [46.101.3.207]
Block [57.128.11.39]
Block [94.231.15.16]
DEADWOOD:
Anyone in your company who is more senior than you are.
Block [101.42.161.122]
Block [119.240.188.148]
Block [129.152.11.208]
Block [191.195.158.73]
Block [194.32.123.67]
Block [27.50.88.75]
Block [34.132.42.210]
Block [43.129.246.75]
Block [43.138.50.80]
Block [43.143.82.193]
Block [46.101.3.207]
Block [57.128.11.39]
Block [94.231.15.16]
DEADWOOD:
Anyone in your company who is more senior than you are.