Security Scare? / suspiciously high number of authentication failures

Replace JAIL by sshd for the jailed SSH attempts, yunohost for a lot of things.

There should be something with nginxtoo. You can list the jail by using sudo fail2ban-client status.

If you only want to display the SSH failed attempts, you can do something like sudo grep "invalid" /var/log/auth.log.

And if you just want to list the IP : grep "invalid" /var/log/auth.log* | grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | sort | uniq | sort -n

This little script I made could also interest you => [GeoIP] [Fail2Ban] Bannir les tentatives de connexions par mod_proxy ou par SSH