Regarding the AbuseIPDB link: some of the SSH payloads mentioned in the instances of 'attack' contain the username jiat75.
Doesn't necessarily validate anything though. Could be progressof planting misdirection given that the IP address only started being detected basically today (and the VPS was likely only just setup today as well, if the hostname is to be trusted).
... and that progressof's account is about an hour old.
I didn't come to any conclusion... and I don't think you missed anything... I'm just posting links... you think it's better if I didn't post anything because this is stupid? if so then ok...
Also check this... https://www.abuseipdb.com/check/64.23.252.16