xmlrpc attack

2020-06-07T20:22:16.017607shield sshd\[32502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root
2020-06-07T20:22:17.749038shield sshd\[32502\]: Failed password for root from 128.199.220.207 port 55482 ssh2
2020-06-07T20:24:58.142935shield sshd\[32697\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root
2020-06-07T20:25:00.115069shield sshd\[32697\]: Failed password for root from 128.199.220.207 port 42244 ssh2
2020-06-07T20:27:41.705672shield sshd\[626\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root

Jun  7 14:53:54 server1 sshd\[2895\]: Invalid user aombeva from 185.240.65.251
Jun  7 14:53:54 server1 sshd\[2895\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.240.65.251 
Jun  7 14:53:56 server1 sshd\[2895\]: Failed password for invalid user aombeva from 185.240.65.251 port 6664 ssh2
Jun  7 15:02:15 server1 sshd\[5905\]: Invalid user aombeva from 185.240.65.251
Jun  7 15:02:15 server1 sshd\[5905\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.240.65.251 
...

Jun  8 00:15:03 journals sshd\[30606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.24.243  user=root
Jun  8 00:15:05 journals sshd\[30606\]: Failed password for root from 185.69.24.243 port 49346 ssh2
Jun  8 00:18:30 journals sshd\[30989\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.24.243  user=root
Jun  8 00:18:32 journals sshd\[30989\]: Failed password for root from 185.69.24.243 port 52436 ssh2
Jun  8 00:22:03 journals sshd\[31410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.24.243  user=root
...

SMB Server BruteForce Attack

Fail2Ban Ban Triggered

(From bellm1233@gmail.com) Hi there!

I'm a freelance online marketer who's seeking new clients interested in getting more traffic to their websites. Can you please help me out a bit? I'd like to speak to the person in your company who is in charge on managing the website, and I would really appreciate it if you could forward this message to them and have them respond to me. 

If you're in need of SEO, I can assist you for a cheap cost. I've been a freelance search engine optimization specialist for 10 years and can get your site up where you need it to be. Boosting your ranking in search engines can progressively increase the amount of traffic you get in your site. Even just having high placements on Google alone for specific keywords relating to your business can really boost your sales. I'd like to help your company progress to the next level. 

Please write back to let me know if you're interested and I'll provide you with a free consultation and pricing on my services. I hope to speak with you soon

2020-06-07T16:02:51.2033001495-001 sshd[31013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.226.153.29  user=root
2020-06-07T16:02:53.3360891495-001 sshd[31013]: Failed password for root from 43.226.153.29 port 44646 ssh2
2020-06-07T16:05:38.5922541495-001 sshd[31159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.226.153.29  user=root
2020-06-07T16:05:40.3184551495-001 sshd[31159]: Failed password for root from 43.226.153.29 port 60854 ssh2
2020-06-07T16:08:32.4198331495-001 sshd[31236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.226.153.29  user=root
2020-06-07T16:08:34.3667661495-001 sshd[31236]: Failed password for root from 43.226.153.29 port 48848 ssh2
...

Jun  7 23:14:21 debian-2gb-nbg1-2 kernel: \[13823203.631971\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=83.97.20.35 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=TCP SPT=59594 DPT=6669 WINDOW=65535 RES=0x00 SYN URGP=0

 TCP (SYN) 163.172.129.13:54364 -> port 22, len 44

Jun  7 22:27:13 [Censored Hostname] sshd[20035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.129.64.195 
Jun  7 22:27:15 [Censored Hostname] sshd[20035]: Failed password for invalid user aerodynamik from 23.129.64.195 port 37305 ssh2[...]

Jun  7 22:37:01 vps687878 sshd\[25683\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.151.52  user=root
Jun  7 22:37:03 vps687878 sshd\[25683\]: Failed password for root from 46.101.151.52 port 49168 ssh2
Jun  7 22:40:21 vps687878 sshd\[26113\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.151.52  user=root
Jun  7 22:40:24 vps687878 sshd\[26113\]: Failed password for root from 46.101.151.52 port 51426 ssh2
Jun  7 22:43:47 vps687878 sshd\[26676\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.151.52  user=root
...

Jun  7 23:09:11 pve1 sshd[10025]: Failed password for root from 222.186.173.183 port 33092 ssh2
Jun  7 23:09:15 pve1 sshd[10025]: Failed password for root from 222.186.173.183 port 33092 ssh2
...

2020-06-07T22:27:49.522205+02:00  sshd[10352]: Failed password for root from 122.51.41.109 port 59366 ssh2

Lines containing failures of 188.213.173.52
Jun  6 02:29:36 kmh-mb-001 sshd[27669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.213.173.52  user=r.r
Jun  6 02:29:39 kmh-mb-001 sshd[27669]: Failed password for r.r from 188.213.173.52 port 42288 ssh2
Jun  6 02:29:40 kmh-mb-001 sshd[27669]: Received disconnect from 188.213.173.52 port 42288:11: Bye Bye [preauth]
Jun  6 02:29:40 kmh-mb-001 sshd[27669]: Disconnected from authenticating user r.r 188.213.173.52 port 42288 [preauth]
Jun  6 02:43:07 kmh-mb-001 sshd[28181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.213.173.52  user=r.r
Jun  6 02:43:09 kmh-mb-001 sshd[28181]: Failed password for r.r from 188.213.173.52 port 39904 ssh2
Jun  6 02:43:11 kmh-mb-001 sshd[28181]: Received disconnect from 188.213.173.52 port 39904:11: Bye Bye [preauth]
Jun  6 02:43:11 kmh-mb-001 sshd[28181]: Disconnected from authenticating user r.r 188.213.1........
------------------------------