RT-AC3100 Log file is getting bombarded with Dropbear messages

[jgebel]

Hi I have an RT-AC3100 running firmware version 3.0.0.4.380_858 with no issues up to this point. I notice the log file is now flooded with the messages below:
Feb 27 04:48:09 dropbear[10311]: login attempt for nonexistent user from ::ffff:104.233.120.229:39293
Feb 27 04:48:11 dropbear[10312]: login attempt for nonexistent user from ::ffff:104.233.120.229:39373
Feb 27 04:48:12 dropbear[10313]: login attempt for nonexistent user from ::ffff:104.233.120.229:39430
Feb 27 04:48:13 dropbear[10314]: login attempt for nonexistent user from ::ffff:104.233.120.229:39494
Feb 27 04:48:14 dropbear[10353]: login attempt for nonexistent user from ::ffff:104.233.120.229:39559
Feb 27 04:48:15 dropbear[10395]: login attempt for nonexistent user from ::ffff:104.233.120.229:39605
Feb 27 04:48:16 dropbear[10472]: login attempt for nonexistent user from ::ffff:104.233.120.229:39670
Feb 27 04:48:17 dropbear[10473]: login attempt for nonexistent user from ::ffff:104.233.120.229:39709
Feb 27 04:48:18 dropbear[10480]: login attempt for nonexistent user from ::ffff:104.233.120.229:39762
Feb 27 04:48:19 dropbear[10481]: login attempt for nonexistent user from ::ffff:104.233.120.229:39803
Feb 27 04:48:20 dropbear[10482]: login attempt for nonexistent user from ::ffff:104.233.120.229:39850
Feb 27 04:48:21 dropbear[10483]: login attempt for nonexistent user from ::ffff:104.233.120.229:39897
Feb 27 04:48:22 dropbear[10484]: login attempt for nonexistent user from ::ffff:104.233.120.229:39943

I did a search on the forum for dropbear but could only find old threads and nothing recent for this model router. I do have SSH enabled but have a strong password. Is this something I should be concerned with?

 

[RMerlin]

This is because you opened SSH access to WAN (those connections are from a public IP). I recommend not opening SSH to WAN unless having a very good reason to do so. Otherwise, as long you have a secure password you should be fine, but you will regularly get spiders and malwares scanning for vulnerable SSH servers, so be prepared to see them on a regular basis in your log.