I had the same issue.
I was able to find the IP address via vCenter > click host > Monitor > Tasks & Events > Events. Each failed logon would show the warning you see on the main summary screen, but also the failed logon attempt like "root@<source IP address>. In my case, I wasn't familiar with the IP I was seeing (likely legacy stuff, this popped up after a root password change), so I modified the firewall settings for SSH and vSphere Web Access to only trust the IP ranges I actually trust. 900 seconds later, good to go, warnings cleared.
IP redacted below, but you get the idea. I believe this was added to vSphere 6.x, FWIW.
