My vultr gets people trying to login to it all the time using rdp, sip, etc. Not a big deal as they are all blocked.
One of the most commons destination ports is 6270, yet i cant find a standard application that uses this.
Certainly not one that would account for nearly 40% of login attempts.
[932292.085268] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:01:a9:b8:5f:fe:00:01:a9:b8:5f:08:00 SRC=some shithead DST=my vps ip LEN=48 TOS=0x00 PREC=0x00 TTL=49 ID=6087 DF PROTO=TCP SPT=60972 DPT=6270 WINDOW=29200 RES=0x00 SYN URGP=0