- port 902/TCP is ssh in that IP.
- Since the source ports change, these are different connections. Since they change increasingly, this is repetition and automated
- Since the size is ~60 bytes, these are not established connections, nor connections that put the password correctly, so they are attempts to connect to ssh and bruteforce the passwrod
- The weird connections to 22/TCP are from the internet and also not with good passwords (too small)
- DNS is ok
- Summary: this is an ssh brute force. So it is malicious or suspicioius.
be sure to update the documentation, and file name
be sure to update the documentation, and file name