$ last | tac
You can use last to get an idea where your connections are coming from:
wtmp begins Tue Oct 13 17:20:47 2020
reboot system boot 3.10.0-1127.el7. Tue Oct 13 17:20 - 17:43 (00:22)
reboot system boot 3.10.0-1127.19.1 Thu Jan 28 05:46 - 04:38 (250+22:52)
root pts/0 182.68.178.174 Thu Jan 28 05:54 - 05:56 (00:01)
root pts/0 182.68.178.174 Thu Jan 28 05:56 - crash (00:04)
reboot system boot 3.10.0-1127.19.1 Thu Jan 28 06:01 - 04:38 (250+22:37)
root pts/0 182.68.178.174 Thu Jan 28 08:35 - 09:47 (01:12)
root pts/0 182.68.178.174 Thu Jan 28 12:20 - 12:29 (00:09)
root pts/0 182.68.183.159 Fri Jan 29 04:51 - 06:40 (01:48)
root pts/0 182.68.60.189 Mon Feb 1 07:05 - 08:11 (01:06)
root pts/0 182.68.60.189 Mon Feb 1 08:12 - 10:23 (02:11)
root pts/1 42.111.3.175 Mon Feb 1 08:35 - 08:36 (00:01)
root pts/1 182.68.60.189 Mon Feb 1 08:38 - 09:24 (00:46)
root pts/0 182.68.60.189 Mon Feb 1 12:06 - 12:09 (00:02)
root pts/0 122.161.240.187 Fri Feb 5 15:39 - 15:42 (00:02)
root pts/0 122.161.240.187 Fri Feb 5 16:40 - 16:50 (00:09)
root pts/0 122.161.240.53 Sat Feb 6 05:14 - 05:15 (00:01)
root pts/0 122.161.240.53 Sat Feb 6 08:55 - 08:57 (00:01)
root pts/0 122.161.245.53 Sun Feb 7 07:10 - 07:13 (00:03)
root pts/0 122.161.241.124 Mon Feb 8 04:23 - 04:29 (00:06)
