I looked in /var/log/auth.log and found a number of entires I didn't like. Here's a list of IP addresses I saw.
Block [110.78.228.117]
Block [120.221.247.158]
Block [139.59.57.84]
Block [176.194.52.87]
Block [195.19.96.168]
Block [210.235.48.82]
Block [221.2.93.118]
Block [40.88.10.248]
Block [43.142.34.186]
Block [92.118.61.80]
unix soit qui mal y pense
Block [110.78.228.117]
Block [120.221.247.158]
Block [139.59.57.84]
Block [176.194.52.87]
Block [195.19.96.168]
Block [210.235.48.82]
Block [221.2.93.118]
Block [40.88.10.248]
Block [43.142.34.186]
Block [92.118.61.80]
unix soit qui mal y pense