I don't think I've had a box up in the last decade where I haven't seen this. The brute force attempts against ssh, and scans for vulnerable services are pretty

I don't think I've had a box up in the last decade where I haven't seen this. The brute force attempts against ssh, and scans for vulnerable services are pretty constant. Commercial / datacenter / residential ip doesn't seem to make much of a difference. Unless you have a really bad password, its generally not an issue as the rate of the scan is pretty low. You could always run fail2ban or denyhosts to keep your logs cleaner, firewall the port off to known ips and/or set up port knocking, or change the port it listens on. (Note: Doing any of those is only a trivial increase at best security wise, its more to get rid of the log spam.) At one point I had a script that parsed logs and added any ip with >= 10 failed attempts to an iptables chain which dropped all traffic. It would generally grow by a few hundred hosts every week.