xmlrpc attack

Jul  3 02:05:47 dallas01 sshd[16295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.173.55.8
Jul  3 02:05:49 dallas01 sshd[16295]: Failed password for invalid user hu from 220.173.55.8 port 61786 ssh2
Jul  3 02:07:58 dallas01 sshd[16542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.173.55.8
Jul  3 02:07:59 dallas01 sshd[16542]: Failed password for invalid user guest from 220.173.55.8 port 13973 ssh2

(from noreply@business-loan-funding.pro) Hi, letting you know that http://Business-Loan-Funding.pro?url=ocfrw.org can find your business a SBA or private loan for $2,000 - $350K Without high credit or collateral. 
 
Find Out how much you qualify for by clicking here: 
 
http://Business-Loan-Funding.pro?url=ocfrw.org 
 
Minimum requirements include your company being established for at least a year and with current gross revenue of at least 120K. Eligibility and funding can be completed in as fast as 48hrs. Terms are personalized for each business so I suggest applying to find out exactly how much you can get on various terms. 
 
This is a free service from a qualified lender and the approval will be based on the annual revenue of your business. These funds are Non-Restrictive, allowing you to spend the full amount in any way you require including business debt consolidation, hiring, marketing, or Absolutely Any Other expense. 
 
If you need fast and easy business funding take a look at these program

Lines containing failures of 45.32.67.38
Oct  7 09:42:07 zabbix sshd[62724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.32.67.38  user=r.r
Oct  7 09:42:09 zabbix sshd[62724]: Failed password for r.r from 45.32.67.38 port 47236 ssh2
Oct  7 09:42:09 zabbix sshd[62724]: Received disconnect from 45.32.67.38 port 47236:11: Bye Bye [preauth]
Oct  7 09:42:09 zabbix sshd[62724]: Disconnected from authenticating user r.r 45.32.67.38 port 47236 [preauth]
Oct  7 10:00:48 zabbix sshd[64600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.32.67.38  user=r.r
Oct  7 10:00:50 zabbix sshd[64600]: Failed password for r.r from 45.32.67.38 port 37874 ssh2
Oct  7 10:00:50 zabbix sshd[64600]: Received disconnect from 45.32.67.38 port 37874:11: Bye Bye [preauth]
Oct  7 10:00:50 zabbix sshd[64600]: Disconnected from authenticating user r.r 45.32.67.38 port 37874 [preauth]
Oct  7 10:04:28 zabbix sshd[6486........
------------------------------

xmlrpc attack

Oct  8 14:11:56 vtv3 sshd\[6778\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.188.40  user=root
Oct  8 14:11:57 vtv3 sshd\[6778\]: Failed password for root from 182.61.188.40 port 44472 ssh2
Oct  8 14:16:24 vtv3 sshd\[8994\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.188.40  user=root
Oct  8 14:16:25 vtv3 sshd\[8994\]: Failed password for root from 182.61.188.40 port 56606 ssh2
Oct  8 14:20:39 vtv3 sshd\[11309\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.188.40  user=root
Oct  8 14:33:44 vtv3 sshd\[17627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.188.40  user=root
Oct  8 14:33:46 vtv3 sshd\[17627\]: Failed password for root from 182.61.188.40 port 48666 ssh2
Oct  8 14:38:06 vtv3 sshd\[19833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.6

SASL broute force

Oct  8 03:45:19 sachi sshd\[25620\]: Invalid user Admin@333 from 104.246.113.80
Oct  8 03:45:19 sachi sshd\[25620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ool-68f67150.dyn.optonline.net
Oct  8 03:45:20 sachi sshd\[25620\]: Failed password for invalid user Admin@333 from 104.246.113.80 port 33258 ssh2
Oct  8 03:49:40 sachi sshd\[25972\]: Invalid user Docteur@123 from 104.246.113.80
Oct  8 03:49:40 sachi sshd\[25972\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ool-68f67150.dyn.optonline.net

2019-10-08T14:49:00.117462shield sshd\[7422\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.226.153.44  user=root
2019-10-08T14:49:02.120576shield sshd\[7422\]: Failed password for root from 43.226.153.44 port 51240 ssh2
2019-10-08T14:53:13.114995shield sshd\[8575\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.226.153.44  user=root
2019-10-08T14:53:15.519649shield sshd\[8575\]: Failed password for root from 43.226.153.44 port 50552 ssh2
2019-10-08T14:57:33.046172shield sshd\[9590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.226.153.44  user=root

10/08/2019-07:53:35.680295 219.131.222.26 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Oct  8 15:21:39 relay postfix/smtpd\[1466\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.141\]: 554 5.7.1 \: Relay access denied\; from=\<71n4w8glwawl@castolin.nl\> to=\ proto=ESMTP helo=\<\[193.32.160.135\]\>
Oct  8 15:21:39 relay postfix/smtpd\[1466\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.141\]: 554 5.7.1 \: Relay access denied\; from=\<71n4w8glwawl@castolin.nl\> to=\ proto=ESMTP helo=\<\[193.32.160.135\]\>
Oct  8 15:21:39 relay postfix/smtpd\[1466\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.141\]: 554 5.7.1 \: Relay access denied\; from=\<71n4w8glwawl@castolin.nl\> to=\ proto=ESMTP helo=\<\[193.32.160.135\]\>
Oct  8 15:21:39 relay postfix/smtpd\[1466\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.141\]: 554 5.7.1 \: Relay access denied\; from=\
...

Attempts to probe for or exploit a Drupal site on url: /wp-login.php. Reported by the module https://www.drupal.org/project/abuseipdb.

Oct  7 08:47:28 zimbra sshd[17194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.102.190  user=r.r
Oct  7 08:47:30 zimbra sshd[17194]: Failed password for r.r from 106.52.102.190 port 58079 ssh2
Oct  7 08:47:31 zimbra sshd[17194]: Received disconnect from 106.52.102.190 port 58079:11: Bye Bye [preauth]
Oct  7 08:47:31 zimbra sshd[17194]: Disconnected from 106.52.102.190 port 58079 [preauth]
Oct  7 09:14:26 zimbra sshd[2295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.102.190  user=r.r
Oct  7 09:14:28 zimbra sshd[2295]: Failed password for r.r from 106.52.102.190 port 40248 ssh2
Oct  7 09:14:29 zimbra sshd[2295]: Received disconnect from 106.52.102.190 port 40248:11: Bye Bye [preauth]
Oct  7 09:14:29 zimbra sshd[2295]: Disconnected from 106.52.102.190 port 40248 [preauth]
Oct  7 09:19:15 zimbra sshd[5304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=........
-------------------------------

Oct  8 14:55:01 piServer sshd[26252]: Failed password for root from 218.92.0.173 port 49315 ssh2
Oct  8 14:55:04 piServer sshd[26252]: Failed password for root from 218.92.0.173 port 49315 ssh2
Oct  8 14:55:09 piServer sshd[26252]: Failed password for root from 218.92.0.173 port 49315 ssh2
Oct  8 14:55:14 piServer sshd[26252]: Failed password for root from 218.92.0.173 port 49315 ssh2
...

xmlrpc attack

Oct  8 16:00:04 web1 postfix/smtpd\[24453\]: warning: unknown\[122.155.174.36\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 16:00:31 web1 postfix/smtpd\[24453\]: warning: unknown\[122.155.174.36\]: SASL LOGIN authentication failed: Connection lost to authentication server
Oct  8 16:03:41 web1 postfix/smtpd\[24810\]: warning: unknown\[122.155.174.36\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6