Information gathering for ssh attacks / 2017-10-16

Someone has been looking at websites I run to think of ssh login names to try:

Oct 16 16:21:53 greenblatt sshd[19367]: Invalid user weather from 223.194.227.104
Oct 16 16:22:11 greenblatt sshd[19387]: Invalid user weatherstation from 223.194.227.104
Oct 16 16:55:07 greenblatt sshd[22596]: Invalid user weerstation from 223.194.227.104

All valid and published websites on this system: http://weather.idefix.net/, http://weatherstation.idefix.net/, http://weerstation.idefix.net/.