every min they were brute forcing my sshd which I found from /var/log/auth.log also I saw a few unusual entries in my db.