SSH attacks?

[Robin <robin () kallisti net nz>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

While looking through the logs after someone ran over my system with Nessus, I 
noticed some odd ones from sshd (that don't seem to be related to the nessus 
scan):
Jul 27 03:12:25 kallisti sshd[16471]: error: Could not get shadow information 
for NOUSER

They usually, although not always occur in pairs, a few seconds apart. They 
don't seem to be very random, which suggests maybe that there is someone at 
the other end, rather than a worm.

The first sighting was Jun 4 04:22:15 (all times NZST), with 153 instances 
going to 04:47:03 (this is fairly constant, and not in pairs). It isn't seen 
again until Jun 17 08:39:54-08:58:20 (75 instances this time, again not in 
pairs). Since then, there have been a few on the 21st and 25th, followed by a 
lot on the 26th and into the 27th, where we now see the pairs coming up.

Looking a bit closer (and in other log files), I see it's people trying random 
accounts. The big ones are going over a large list, the pairs seem to be just 
hitting test and guest:
Jul 26 23:05:59 kallisti sshd[12314]: Illegal user test 
from ::ffff:64.246.56.44
Jul 26 23:05:59 kallisti sshd[12314]: Failed password for illegal user test 
from ::ffff:64.246.56.44 port 41920 ssh2
Jul 26 23:06:01 kallisti sshd[12320]: Illegal user guest 
from ::ffff:64.246.56.44
Jul 26 23:06:01 kallisti sshd[12320]: Failed password for illegal user guest 
from ::ffff:64.246.56.44 port 41967 ssh2

Does anyone know why this would appear all of a sudden?
- -- 
Robin <robin () kallisti net nz>             JabberID: <eythian () jabber org>

Hostes alienigeni me abduxerunt. Qui annus est?

PGP Key 0x776DB663 = DD10 5C62 1E29 A385 9866 0853 CD38 E07A 776D B663
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBBYy7zTjgendttmMRApC3AJ4jPltp7rCFbrMmYHNOAYqd0k7bRQCeLOH1
IOBWhIi1EhWcT6YqNTJi9Jk=
=tpcb
-----END PGP SIGNATURE-----