The IP 50.63.84.70 has just been banned by Fail2Ban after 19 attempts against SSH. Latest lines containing IP:50.63.84.70 in /var/log/syslog/sshd.log Aug 9 17:42:04 ftlogin2 sshd[30106]: error: PAM: User not known to the underlying authentication module for illegal user admin from ip-50-63-84-70.ip.secureserver.net Aug 9 17:42:04 ftlogin2 sshd[30106]: Failed keyboard-interactive/pam for invalid user admin from 50.63.84.70 port 37460 ssh2 Aug 9 17:42:14 ftlogin2 sshd[30113]: Invalid user admin from 50.63.84.70 Aug 9 17:42:14 ftlogin2 sshd[30116]: Postponed keyboard-interactive for invalid user admin from 50.63.84.70 port 37658 ssh2 Aug 9 17:42:15 ftlogin2 sshd[30113]: error: PAM: User not known to the underlying authentication module for illegal user admin from ip-50-63-84-70.ip.secureserver.net Aug 9 17:42:15 ftlogin2 sshd[30113]: Failed keyboard-interactive/pam for invalid user admin from 50.63.84.70 port 37658 ssh2 Aug 9 17:42:15 ftlogin2 sshd[30116]: Postponed keyboard-interactive for invalid user admin from 50.63.84.70 port 37658 ssh2 Aug 9 17:42:16 ftlogin2 sshd[30113]: error: PAM: User not known to the underlying authentication module for illegal user admin from ip-50-63-84-70.ip.secureserver.net Aug 9 17:42:16 ftlogin2 sshd[30113]: Failed keyboard-interactive/pam for invalid user admin from 50.63.84.70 port 37658 ssh2 Aug 9 17:42:17 ftlogin2 sshd[30116]: Postponed keyboard-interactive for invalid user admin from 50.63.84.70 port 37658 ssh2 - Fail2ban on