This question already has an answer here:
A couple of days ago I logged in to a linux VM and the VM said there were 12000 failed login attempts. After each login it kept informing me of failed login attempts so I started to monitor my firewall logs on the host machine (who now also covers the VMs) and I keep finding incoming requests for DNS, telnet, http and ssh.
As you can see, seemingly random hosts keep connecting to my host and/or VMs using various ports.
I began using the server a week ago and all I did was bind my domain to it and some VMs on it. There are however no real services running on it (except some test environments like HTTPD).
I'd like to note the host machine has had ransomware (Dharma) for a brief moment (I completely reinstalled it after a day).
This has been going on for a couple of days and as soon as the server comes online it continues. I assume this is an attack? If so, is there something I can do about it or do I just wait it out?