“There were a total of 11,599 login attempts. Divided by 30 days, this means an average of 386 login attempts per day.”
386 tries a day on one Ubuntu box nobody had heard of. The bots go for default usernames and passwords. One attack plants an SSH key signed “mdrfckr”. A crypto miner wipes the folder, adds its own key, kills rival miners and locks everyone else out. If your SSH accepts passwords, someone is already guessing them.