[portscan] tcp/21 [FTP]
[scan/connect: 6 time(s)]
*(RWIN=65535)(12211217)

Dec 21 09:05:34 marvibiene sshd[35858]: Invalid user akiba from 83.240.245.242 port 44688
Dec 21 09:05:34 marvibiene sshd[35858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.240.245.242
Dec 21 09:05:34 marvibiene sshd[35858]: Invalid user akiba from 83.240.245.242 port 44688
Dec 21 09:05:36 marvibiene sshd[35858]: Failed password for invalid user akiba from 83.240.245.242 port 44688 ssh2
...

$f2bV_matches

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.48.101.184  user=root
Failed password for root from 83.48.101.184 port 15041 ssh2
Invalid user mysql from 83.48.101.184 port 30568
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.48.101.184
Failed password for invalid user mysql from 83.48.101.184 port 30568 ssh2

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.217.109  user=root
Failed password for root from 150.95.217.109 port 52474 ssh2
Invalid user home from 150.95.217.109 port 57654
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.217.109
Failed password for invalid user home from 150.95.217.109 port 57654 ssh2

Dec 21 11:45:15 localhost sshd\[18574\]: Invalid user mas from 223.4.68.38 port 36636
Dec 21 11:45:15 localhost sshd\[18574\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.4.68.38
Dec 21 11:45:16 localhost sshd\[18574\]: Failed password for invalid user mas from 223.4.68.38 port 36636 ssh2

Dec 21 00:00:20 hanapaa sshd\[19205\]: Invalid user souyou from 149.129.251.152
Dec 21 00:00:20 hanapaa sshd\[19205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.129.251.152
Dec 21 00:00:22 hanapaa sshd\[19205\]: Failed password for invalid user souyou from 149.129.251.152 port 35030 ssh2
Dec 21 00:07:08 hanapaa sshd\[19969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.129.251.152  user=root
Dec 21 00:07:09 hanapaa sshd\[19969\]: Failed password for root from 149.129.251.152 port 41278 ssh2

Dec 21 08:59:24 localhost sshd\[31108\]: Invalid user guest from 140.246.124.36
Dec 21 08:59:24 localhost sshd\[31108\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.124.36
Dec 21 08:59:27 localhost sshd\[31108\]: Failed password for invalid user guest from 140.246.124.36 port 44930 ssh2
Dec 21 09:06:55 localhost sshd\[31594\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.124.36  user=root
Dec 21 09:06:57 localhost sshd\[31594\]: Failed password for root from 140.246.124.36 port 41116 ssh2
...

Dec 21 06:54:15 localhost sshd[11960]: Failed password for invalid user fagerlund from 149.129.251.229 port 39640 ssh2
Dec 21 07:12:28 localhost sshd[12787]: Failed password for invalid user host from 149.129.251.229 port 42242 ssh2
Dec 21 07:26:46 localhost sshd[13499]: Failed password for invalid user thomassen from 149.129.251.229 port 48296 ssh2

Dec 21 10:31:12 sd-53420 sshd\[29874\]: Invalid user debug from 182.16.162.202
Dec 21 10:31:12 sd-53420 sshd\[29874\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.16.162.202
Dec 21 10:31:14 sd-53420 sshd\[29874\]: Failed password for invalid user debug from 182.16.162.202 port 36644 ssh2
Dec 21 10:37:45 sd-53420 sshd\[32251\]: Invalid user user from 182.16.162.202
Dec 21 10:37:45 sd-53420 sshd\[32251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.16.162.202
...

Triggered by Fail2Ban at Vostok web server

Dec 20 11:57:00 ovpn sshd[18740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.39.29.252  user=r.r
Dec 20 11:57:03 ovpn sshd[18740]: Failed password for r.r from 5.39.29.252 port 50684 ssh2
Dec 20 11:57:03 ovpn sshd[18740]: Received disconnect from 5.39.29.252 port 50684:11: Bye Bye [preauth]
Dec 20 11:57:03 ovpn sshd[18740]: Disconnected from 5.39.29.252 port 50684 [preauth]
Dec 20 12:04:32 ovpn sshd[20634]: Invalid user mariyapillai from 5.39.29.252
Dec 20 12:04:32 ovpn sshd[20634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.39.29.252
Dec 20 12:04:34 ovpn sshd[20634]: Failed password for invalid user mariyapillai from 5.39.29.252 port 51696 ssh2
Dec 20 12:04:34 ovpn sshd[20634]: Received disconnect from 5.39.29.252 port 51696:11: Bye Bye [preauth]
Dec 20 12:04:34 ovpn sshd[20634]: Disconnected from 5.39.29.252 port 51696 [preauth]

........
-----------------------------------------------
https://www.blocklist.de/en/v

Unauthorized connection attempt detected from IP address 104.238.221.65 to port 445

Dec 21 08:23:29 elektron postfix/smtpd\[31659\]: NOQUEUE: reject: RCPT from unknown\[112.85.193.6\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.85.193.6\]\; from=\ to=\ proto=ESMTP helo=\
Dec 21 08:24:31 elektron postfix/smtpd\[31659\]: NOQUEUE: reject: RCPT from unknown\[112.85.193.6\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.85.193.6\]\; from=\ to=\ proto=ESMTP helo=\
Dec 21 08:25:22 elektron postfix/smtpd\[31659\]: NOQUEUE: reject: RCPT from unknown\[112.85.193.6\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.85.193.6\]\; from=\ to=\ proto=ESMTP helo=\
Dec 21 08:26:18 elektron postfix/smtpd\[30768\]: NOQUEUE: reject: RCPT from unknown\[112.85.193.6\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.85.193.6\]\; from=\ to=\ proto=ESMTP helo=\

Dec 21 10:42:29 ns381471 sshd[19681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.19.15.71
Dec 21 10:42:31 ns381471 sshd[19681]: Failed password for invalid user admin1 from 188.19.15.71 port 53406 ssh2