Bruteforce detected by fail2ban

Apr 30 14:27:57 sxvn sshd[487734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.220.235.64

[portscan] Port scan

Apr 30 15:19:20 ift sshd\[13456\]: Failed password for root from 119.29.180.179 port 52248 ssh2Apr 30 15:23:44 ift sshd\[13910\]: Invalid user cunningham from 119.29.180.179Apr 30 15:23:45 ift sshd\[13910\]: Failed password for invalid user cunningham from 119.29.180.179 port 42204 ssh2Apr 30 15:28:08 ift sshd\[14814\]: Invalid user gq from 119.29.180.179Apr 30 15:28:10 ift sshd\[14814\]: Failed password for invalid user gq from 119.29.180.179 port 60460 ssh2
...

Apr 30 09:28:21 firewall sshd[26859]: Failed password for root from 222.186.31.166 port 56320 ssh2
Apr 30 09:28:24 firewall sshd[26859]: Failed password for root from 222.186.31.166 port 56320 ssh2
Apr 30 09:28:26 firewall sshd[26859]: Failed password for root from 222.186.31.166 port 56320 ssh2
...

2020-04-30T13:03:42.011775shield sshd\[461\]: Invalid user lcd from 192.144.187.153 port 56874
2020-04-30T13:03:42.016821shield sshd\[461\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.187.153
2020-04-30T13:03:43.451133shield sshd\[461\]: Failed password for invalid user lcd from 192.144.187.153 port 56874 ssh2
2020-04-30T13:05:23.890109shield sshd\[822\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.187.153  user=root
2020-04-30T13:05:25.524923shield sshd\[822\]: Failed password for root from 192.144.187.153 port 46198 ssh2

2020-04-30T14:44:58.762128sd-86998 sshd[28261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.ip-137-74-166.eu  user=root
2020-04-30T14:45:00.558186sd-86998 sshd[28261]: Failed password for root from 137.74.166.77 port 44232 ssh2
2020-04-30T14:49:23.488708sd-86998 sshd[28833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.ip-137-74-166.eu  user=root
2020-04-30T14:49:25.997665sd-86998 sshd[28833]: Failed password for root from 137.74.166.77 port 55752 ssh2
2020-04-30T14:53:33.648961sd-86998 sshd[29170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.ip-137-74-166.eu  user=root
2020-04-30T14:53:35.811551sd-86998 sshd[29170]: Failed password for root from 137.74.166.77 port 39038 ssh2
...

2020-04-30T08:41:10.411388xentho-1 sshd[295782]: Failed password for root from 222.186.175.202 port 22628 ssh2
2020-04-30T08:41:03.492853xentho-1 sshd[295782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.202  user=root
2020-04-30T08:41:05.696226xentho-1 sshd[295782]: Failed password for root from 222.186.175.202 port 22628 ssh2
2020-04-30T08:41:10.411388xentho-1 sshd[295782]: Failed password for root from 222.186.175.202 port 22628 ssh2
2020-04-30T08:41:14.720725xentho-1 sshd[295782]: Failed password for root from 222.186.175.202 port 22628 ssh2
2020-04-30T08:41:03.492853xentho-1 sshd[295782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.202  user=root
2020-04-30T08:41:05.696226xentho-1 sshd[295782]: Failed password for root from 222.186.175.202 port 22628 ssh2
2020-04-30T08:41:10.411388xentho-1 sshd[295782]: Failed password for root from 222.186.175.202 port 22628 ssh2
2020-0
...

no

Apr 30 14:14:24 server sshd[13448]: Failed password for invalid user floor from 210.212.29.215 port 56254 ssh2
Apr 30 14:23:02 server sshd[15235]: Failed password for invalid user nora from 210.212.29.215 port 54324 ssh2
Apr 30 14:27:59 server sshd[16344]: Failed password for invalid user frank from 210.212.29.215 port 37420 ssh2

Microsoft Mail Internet Headers Version 2.0
Received: from smtp08.amf-envoi.fr ([222.218.17.199]) by xxx with Microsoft SMTPSVC(6.0.3790.1830);
	 Thu, 30 Apr 2020 14:22:52 +0200
Return-Path: 
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	s=neolane;
	d=mail.mutualfirst.com;
	h=domainkey-signature:from:date:subject:to:reply-to:mime-version:x-mailer:message-id:x-250ok-cid:tenantheader:affinity:x-cust_messageid:x-cust_deliveryid:x-cust_instancename:messagemaxretry:messageretryperiod:messagewebvalidityduration:messagevalidityduration:x-cust_imsorgid:content-type;
	bh=Y2nHG3SSivsVKyFi1AdrfHePKyWz2fqvBGFuc2cweq8=;
	b=aVduqy418SlsI4o/vhualJyUhA7Y0A8cWL+XhUectdkQ7LOtB8KwdDGd3b3x1LcdRnGRN4mtrQGJipZNxbACqjxxq4U1ZWw0cOyxIQvtRmTC9LqD9XVxkYpyei7+5LU7ArDh3cb1zC59xTF20IYDAAsKIbYXgX37j24DNz0/Vi0=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns;
	s=neolane;
	d=mail.mutualfirst.com;
	h=From:Date:Subject:To:Reply-To:MIME-Version:X-mailer:Message-ID:X-250ok-CID:TenantHeader:Af

1588249679 - 04/30/2020 14:27:59 Host: 125.26.97.50/125.26.97.50 Port: 445 TCP Blocked

Honeypot attack, port: 445, PTR: PTR record not found

Apr 30 14:44:11 pve1 sshd[2818]: Failed password for root from 222.186.173.183 port 21042 ssh2
Apr 30 14:44:17 pve1 sshd[2818]: Failed password for root from 222.186.173.183 port 21042 ssh2
...

$f2bV_matches | Triggered by Fail2Ban at Vostok web server