Reader xemaps wrote in with this log snippet:
"Whole day my server has been targeted by a botnet, attacker also changed ip each new dictionary user."
Jun 17 23:02:03 pro sshd[17444]: Invalid user mailer from 217.37.x.x Jun 17 23:03:24 pro sshd[17460]: Invalid user mailer from 87.66.x.x Jun 17 23:05:27 pro sshd[17617]: Invalid user mailman from 89.97.x.x Jun 17 23:09:30 pro sshd[17639]: Invalid user mailtest from 62.2.x.x Jun 17 23:15:44 pro sshd[17894]: Invalid user maker from 83.236.x.x Jun 17 23:16:47 pro sshd[17925]: Invalid user mama from 84.73.x.x
The link for this article located at SANS is no longer available.