Portscan or hack attempt detected by psad/fwsnort

Mar  3 15:52:39 vtv3 sshd[22430]: Failed password for invalid user zte from 217.29.21.66 port 60065 ssh2
Mar  3 15:55:26 vtv3 sshd[23770]: Invalid user ka from 217.29.21.66 port 49071
Mar  3 15:55:26 vtv3 sshd[23770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.29.21.66
Mar  5 03:48:06 vtv3 sshd[19690]: Invalid user webcal01 from 217.29.21.66 port 60762
Mar  5 03:48:06 vtv3 sshd[19690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.29.21.66
Mar  5 03:48:09 vtv3 sshd[19690]: Failed password for invalid user webcal01 from 217.29.21.66 port 60762 ssh2
Mar  5 03:54:30 vtv3 sshd[22431]: Invalid user svn from 217.29.21.66 port 49473
Mar  5 03:54:30 vtv3 sshd[22431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.29.21.66
Dec  8 15:41:33 vtv3 sshd[21696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.29.21.66 
Dec  8 15:41:35 vtv3 ssh

Dec  8 19:59:23 sauna sshd[25285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.159.181
Dec  8 19:59:26 sauna sshd[25285]: Failed password for invalid user wigand from 148.70.159.181 port 40252 ssh2
...

Dec  8 07:41:33 php1 sshd\[15451\]: Invalid user pa55w0rd from 156.236.69.242
Dec  8 07:41:33 php1 sshd\[15451\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.69.242
Dec  8 07:41:35 php1 sshd\[15451\]: Failed password for invalid user pa55w0rd from 156.236.69.242 port 55775 ssh2
Dec  8 07:48:13 php1 sshd\[16336\]: Invalid user wakamura from 156.236.69.242
Dec  8 07:48:13 php1 sshd\[16336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.69.242

Dec  8 15:46:08 legacy sshd[4934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.61.51
Dec  8 15:46:09 legacy sshd[4934]: Failed password for invalid user ching from 111.230.61.51 port 35766 ssh2
Dec  8 15:54:02 legacy sshd[5151]: Failed password for root from 111.230.61.51 port 38852 ssh2
...

Portscan detected

Dec  8 15:54:16 grey postfix/smtpd\[25993\]: NOQUEUE: reject: RCPT from unknown\[49.88.67.232\]: 554 5.7.1 Service unavailable\; Client host \[49.88.67.232\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=49.88.67.232\; from=\ to=\ proto=ESMTP helo=\
...

Fail2Ban Ban Triggered

$f2bV_matches

Dec  8 15:48:49 vpn01 sshd[5451]: Failed password for root from 188.165.211.201 port 53678 ssh2
...

198.20.87.98 was recorded 6 times by 5 hosts attempting to connect to the following ports: 113,8069,7443,9600,9200. Incident counter (4h, 24h, all-time): 6, 28, 979

Dec  8 08:25:20 web1 sshd\[32599\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.148  user=root
Dec  8 08:25:23 web1 sshd\[32599\]: Failed password for root from 218.92.0.148 port 42997 ssh2
Dec  8 08:25:26 web1 sshd\[32599\]: Failed password for root from 218.92.0.148 port 42997 ssh2
Dec  8 08:25:29 web1 sshd\[32599\]: Failed password for root from 218.92.0.148 port 42997 ssh2
Dec  8 08:25:33 web1 sshd\[32599\]: Failed password for root from 218.92.0.148 port 42997 ssh2

scan z

2019-12-08T14:54:33.698221abusebot-4.cloudsearch.cf sshd\[15064\]: Invalid user ssh from 156.234.192.2 port 52779

Dec  8 17:21:02 IngegnereFirenze sshd[21524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.115.235  user=root
Dec  8 17:21:02 IngegnereFirenze sshd[21524]: User root from 51.68.115.235 not allowed because not listed in AllowUsers
Dec  8 17:21:04 IngegnereFirenze sshd[21524]: Failed password for invalid user root from 51.68.115.235 port 39223 ssh2
...