On one of my servers I run ssh on non-standard port, but still it was discovered by some botnet which is now trying to connect to my server (and, I believe, it scans Internet looking for ssh-enabled servers). I use DenyHost, so their IPs are banned with netfilter and I also use keys instead of passwords so they probably do not have a chance, but my daily report is full of:
Failed logins from: 22.214.171.124 (static-5-2-182-5.rdsnet.ro): 1 time 126.96.36.199 (ns2312134.ovh.net): 1 time 188.8.131.52 (rg1.rivegauche.ru): 1 time 184.108.40.206 (ec2-34-232-136-66.compute-1.amazonaws.com): 1 time ...
I have 44 records today.
As a "good guy" what should I do about it? I can fetch abuse emails and write them i.e.:
$ whois 220.127.116.11 ... % Abuse contact for '18.104.22.168 - 22.214.171.124' is 'email@example.com'
but is it worth doing? Will it help?