www.handydirektreparatur.de 2402:1f00:8001:106:: [19/Sep/2020:17:18:37 +0200] "POST /wp-login.php HTTP/1.1" 200 6643 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
www.handydirektreparatur.de 2402:1f00:8001:106:: [19/Sep/2020:17:18:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4083 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

xmlrpc attack

xmlrpc attack

WordPress wp-login brute force :: 2402:1f00:8001:106:: 0.092 BYPASS [17/Jul/2020:12:14:48  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2003 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

ENG,WP GET /wp-login.php

Sep 27 17:20:59 nextcloud sshd\[8608\]: Invalid user it1 from 210.77.83.75
Sep 27 17:20:59 nextcloud sshd\[8608\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.77.83.75
Sep 27 17:21:01 nextcloud sshd\[8608\]: Failed password for invalid user it1 from 210.77.83.75 port 16598 ssh2
...

Sep 27 14:57:41 xtremcommunity sshd\[27202\]: Invalid user zliu from 54.36.182.244 port 59023
Sep 27 14:57:41 xtremcommunity sshd\[27202\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.182.244
Sep 27 14:57:43 xtremcommunity sshd\[27202\]: Failed password for invalid user zliu from 54.36.182.244 port 59023 ssh2
Sep 27 15:01:00 xtremcommunity sshd\[27300\]: Invalid user polycom from 54.36.182.244 port 54943
Sep 27 15:01:00 xtremcommunity sshd\[27300\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.182.244
...

B: Magento admin pass test (wrong country)

Sep 27 05:07:20 auw2 sshd\[23716\]: Invalid user dod from 51.83.98.52
Sep 27 05:07:20 auw2 sshd\[23716\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.ip-51-83-98.eu
Sep 27 05:07:22 auw2 sshd\[23716\]: Failed password for invalid user dod from 51.83.98.52 port 46866 ssh2
Sep 27 05:11:30 auw2 sshd\[24252\]: Invalid user manuela from 51.83.98.52
Sep 27 05:11:30 auw2 sshd\[24252\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.ip-51-83-98.eu

Sep 27 20:25:51 ArkNodeAT sshd\[17008\]: Invalid user dietpi from 134.175.39.246
Sep 27 20:25:51 ArkNodeAT sshd\[17008\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.39.246
Sep 27 20:25:54 ArkNodeAT sshd\[17008\]: Failed password for invalid user dietpi from 134.175.39.246 port 42530 ssh2

Bell Support
	How do you feel abou­t the cost of your s­ervice?
(unknown [92.53.87.70])

Sep 27 10:40:43 plusreed sshd[31844]: Invalid user bungee from 46.29.8.150
...

(Sep 27)  LEN=40 TTL=49 ID=25357 TCP DPT=8080 WINDOW=15173 SYN 
 (Sep 27)  LEN=40 TTL=49 ID=49553 TCP DPT=8080 WINDOW=61922 SYN 
 (Sep 27)  LEN=40 TTL=49 ID=62897 TCP DPT=8080 WINDOW=61922 SYN 
 (Sep 26)  LEN=40 TTL=49 ID=20779 TCP DPT=8080 WINDOW=61922 SYN 
 (Sep 25)  LEN=40 TTL=49 ID=7056 TCP DPT=8080 WINDOW=15173 SYN 
 (Sep 25)  LEN=40 TTL=49 ID=41239 TCP DPT=8080 WINDOW=61922 SYN 
 (Sep 24)  LEN=40 TTL=49 ID=12746 TCP DPT=8080 WINDOW=55449 SYN 
 (Sep 24)  LEN=40 TTL=48 ID=38207 TCP DPT=8080 WINDOW=64938 SYN 
 (Sep 24)  LEN=40 TTL=49 ID=38297 TCP DPT=8080 WINDOW=55449 SYN 
 (Sep 23)  LEN=40 TTL=49 ID=7683 TCP DPT=8080 WINDOW=64938 SYN 
 (Sep 23)  LEN=40 TTL=49 ID=34943 TCP DPT=8080 WINDOW=64938 SYN 
 (Sep 22)  LEN=40 TTL=49 ID=58337 TCP DPT=8080 WINDOW=64938 SYN 
 (Sep 22)  LEN=40 TTL=49 ID=40510 TCP DPT=8080 WINDOW=55449 SYN

Sep 27 08:27:46 lcdev sshd\[27172\]: Invalid user ubnt from 197.156.67.251
Sep 27 08:27:46 lcdev sshd\[27172\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.156.67.251
Sep 27 08:27:48 lcdev sshd\[27172\]: Failed password for invalid user ubnt from 197.156.67.251 port 51414 ssh2
Sep 27 08:32:52 lcdev sshd\[27631\]: Invalid user employer from 197.156.67.251
Sep 27 08:32:52 lcdev sshd\[27631\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.156.67.251

Sep 27 20:20:17 MK-Soft-VM3 sshd[26002]: Failed password for root from 186.153.138.2 port 53132 ssh2
...

Chat Spam

Sep 27 08:46:41 hanapaa sshd\[20532\]: Invalid user vps from 200.69.236.112
Sep 27 08:46:41 hanapaa sshd\[20532\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.236.112
Sep 27 08:46:44 hanapaa sshd\[20532\]: Failed password for invalid user vps from 200.69.236.112 port 36047 ssh2
Sep 27 08:51:51 hanapaa sshd\[20951\]: Invalid user wwUser from 200.69.236.112
Sep 27 08:51:51 hanapaa sshd\[20951\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.236.112

Sep 27 12:07:35 localhost sshd\[3957\]: Invalid user justin1 from 195.31.160.73 port 34590
Sep 27 12:07:35 localhost sshd\[3957\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.31.160.73
Sep 27 12:07:36 localhost sshd\[3957\]: Failed password for invalid user justin1 from 195.31.160.73 port 34590 ssh2
...

Sep 27 08:27:07 aiointranet sshd\[12923\]: Invalid user ubnt from 202.69.66.130
Sep 27 08:27:07 aiointranet sshd\[12923\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.wantech.com.hk
Sep 27 08:27:09 aiointranet sshd\[12923\]: Failed password for invalid user ubnt from 202.69.66.130 port 59580 ssh2
Sep 27 08:31:04 aiointranet sshd\[13271\]: Invalid user himanshu from 202.69.66.130
Sep 27 08:31:04 aiointranet sshd\[13271\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.wan-tech.net

Sep 27 20:15:33 MK-Soft-Root2 sshd[32130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.7.253 
Sep 27 20:15:35 MK-Soft-Root2 sshd[32130]: Failed password for invalid user jdm from 106.13.7.253 port 57294 ssh2
...