User: Zahor

kept a long “established” connection on non-standard SSH port 2222 without login attempts, indicating an idle connection or resource exhaustion attack. Fail2ban did not detect or block this, as it relies on monitoring authentication failures in logs and cannot track connections without login activity.