\[2019-10-06 08:14:03\] NOTICE\[1887\] chan_sip.c: Registration from '"55" \' failed for '77.247.108.185:5096' - Wrong password
\[2019-10-06 08:14:03\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-06T08:14:03.106-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="55",SessionID="0x7fc3ac095d68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.108.185/5096",Challenge="0ec6fc73",ReceivedChallenge="0ec6fc73",ReceivedHash="d5cbe3c2e09655ab8fa084b8603037dc"
\[2019-10-06 08:14:03\] NOTICE\[1887\] chan_sip.c: Registration from '"55" \' failed for '77.247.108.185:5096' - Wrong password
\[2019-10-06 08:14:03\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-06T08:14:03.236-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="55",SessionID="0x7fc3ac509ad8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.

2019-10-06T11:41:24.870971shield sshd\[4921\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=admin.crf.org  user=root
2019-10-06T11:41:26.197444shield sshd\[4921\]: Failed password for root from 192.241.183.220 port 56780 ssh2
2019-10-06T11:45:14.675029shield sshd\[5336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=admin.crf.org  user=root
2019-10-06T11:45:16.909577shield sshd\[5336\]: Failed password for root from 192.241.183.220 port 48415 ssh2
2019-10-06T11:48:57.578188shield sshd\[5723\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=admin.crf.org  user=root

Oct  6 15:30:36 www2 sshd\[28328\]: Failed password for root from 80.88.90.86 port 53212 ssh2Oct  6 15:34:50 www2 sshd\[28591\]: Failed password for root from 80.88.90.86 port 37652 ssh2Oct  6 15:39:03 www2 sshd\[29081\]: Failed password for root from 80.88.90.86 port 50328 ssh2
...

2019-10-06T11:40:57.766612shield sshd\[4911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.42.76  user=root
2019-10-06T11:40:59.712651shield sshd\[4911\]: Failed password for root from 157.230.42.76 port 44474 ssh2
2019-10-06T11:45:21.657149shield sshd\[5338\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.42.76  user=root
2019-10-06T11:45:23.512699shield sshd\[5338\]: Failed password for root from 157.230.42.76 port 36231 ssh2
2019-10-06T11:49:31.428908shield sshd\[5755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.42.76  user=root

Oct  6 14:15:08 lnxweb61 sshd[28445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.36.44

Automatic report - XMLRPC Attack

WordPress wp-login brute force :: 109.251.62.46 0.124 BYPASS [06/Oct/2019:22:49:12  1100] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

2019-10-06T13:49:04.601409MailD postfix/smtpd[17896]: NOQUEUE: reject: RCPT from host-205-82.host.stetnet.com.br[187.73.205.82]: 554 5.7.1 Service unavailable; Client host [187.73.205.82] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?187.73.205.82; from= to= proto=ESMTP helo=
2019-10-06T13:49:05.212667MailD postfix/smtpd[17896]: NOQUEUE: reject: RCPT from host-205-82.host.stetnet.com.br[187.73.205.82]: 554 5.7.1 Service unavailable; Client host [187.73.205.82] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?187.73.205.82; from= to= proto=ESMTP helo=
2019-10-06T13:49:05.779258MailD postfix/smtpd[17896]: NOQUEUE: reject: RCPT from host-205-82.host.stetnet.com.br[187.73.205.82]: 554 5.7.1 Service unavailable; Client host [187.73.205.82] blocked using bl.spamcop.net; Blocked - see https://w

Oct  6 13:42:47 debian64 sshd\[27143\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.108.181.139  user=root
Oct  6 13:42:49 debian64 sshd\[27143\]: Failed password for root from 114.108.181.139 port 37669 ssh2
Oct  6 13:48:40 debian64 sshd\[28251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.108.181.139  user=root
...

Automatic report - Banned IP Access

www.xn--netzfundstckderwoche-yec.de 185.220.101.61 \[06/Oct/2019:13:48:42 +0200\] "POST /xmlrpc.php HTTP/1.0" 301 537 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/69.0.3497.81 Safari/537.36"
www.xn--netzfundstckderwoche-yec.de 185.220.101.61 \[06/Oct/2019:13:48:43 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 3729 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/69.0.3497.81 Safari/537.36"

2019-10-06T12:19:27.354364abusebot-6.cloudsearch.cf sshd\[23115\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.67  user=root

Oct  6 13:30:26 bouncer sshd\[13937\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.128.70.240  user=root
Oct  6 13:30:28 bouncer sshd\[13937\]: Failed password for root from 177.128.70.240 port 33687 ssh2
Oct  6 13:48:41 bouncer sshd\[14003\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.128.70.240  user=root
...

Oct  6 13:41:23 meumeu sshd[18254]: Failed password for root from 209.235.67.48 port 59871 ssh2
Oct  6 13:45:02 meumeu sshd[18994]: Failed password for root from 209.235.67.48 port 51542 ssh2
...

xmlrpc attack