I just peeked at the server auth logs and noticed a ton of failed login attempts late last night coming from a single source. Its weird cause the attempts didnt follow the usual ssh bruteforce pattern ive seen before. I even found some odd payload fragments mixed in the banner exchange that gave me pauses. Gonna tighten up the firewall rules and maybe ban the whole subnet unless it behaves itself. Cant believe someone is still poking around our boxes like its 1999.