I tried to check who is connecting to my server and got this line I could not recognized. I used sudo lsof -i -n | egrep '\<ssh\>'
.
And these lines looks odd to me:
sshd 5921 sshd 3u IPv4 66008 0t0 TCP 192.168.1.165:ssh->43.229.53.76:59
605 (ESTABLISHED)
sshd 5922 root 3u IPv4 66056 0t0 TCP 192.168.1.165:ssh->43.229.53.76:60
008 (ESTABLISHED)
sshd 5923 sshd 3u IPv4 66056 0t0 TCP 192.168.1.165:ssh->43.229.53.76:60
008 (ESTABLISHED)
sshd 5924 root 3u IPv4 66082 0t0 TCP 192.168.1.165:ssh->43.229.53.76:60
407 (ESTABLISHED)
The address is from HongKong and I am not aware of why that could happen.