Just spotted some nasty brute force attempts in our auth logs this morning. The repeated ssh connections are coming from a host ive never seen before. Looks like theyre trying out a bunch of default creds so they might be scoping us out. Gotta block that traffic and rotate the keys before anything bad happens. Cant sleep easy knowing some stranger is banging on our gateway.