C1,WP GET /wp-login.php

Automatic report - XMLRPC Attack

Dec  2 14:29:30  exim[6802]: [1\53] 1ibllV-0001li-Vk H=lessor.jcnovel.com (lessor.iposttr.com) [63.81.87.153] F= rejected after DATA: This message scored 102.5 spam points.

Automatic report - XMLRPC Attack

$f2bV_matches

Dec  2 21:13:14 hcbbdb sshd\[25899\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.96.190  user=mysql
Dec  2 21:13:16 hcbbdb sshd\[25899\]: Failed password for mysql from 165.227.96.190 port 60986 ssh2
Dec  2 21:18:10 hcbbdb sshd\[26504\]: Invalid user hamlett from 165.227.96.190
Dec  2 21:18:10 hcbbdb sshd\[26504\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.96.190
Dec  2 21:18:12 hcbbdb sshd\[26504\]: Failed password for invalid user hamlett from 165.227.96.190 port 43668 ssh2

Automatic report - Port Scan Attack

Dec  2 02:10:01 *** sshd[5527]: Failed password for invalid user curle from 145.239.83.89 port 57304 ssh2
Dec  2 02:20:16 *** sshd[5676]: Failed password for invalid user saul from 145.239.83.89 port 56536 ssh2
Dec  2 02:25:30 *** sshd[5829]: Failed password for invalid user yoyo from 145.239.83.89 port 40590 ssh2
Dec  2 02:33:01 *** sshd[5963]: Failed password for invalid user guest from 145.239.83.89 port 53364 ssh2
Dec  2 02:38:25 *** sshd[6050]: Failed password for invalid user mysql from 145.239.83.89 port 37972 ssh2
Dec  2 02:48:57 *** sshd[6393]: Failed password for invalid user staying from 145.239.83.89 port 34634 ssh2
Dec  2 02:54:19 *** sshd[6491]: Failed password for invalid user info from 145.239.83.89 port 46716 ssh2
Dec  2 02:59:41 *** sshd[6599]: Failed password for invalid user daring from 145.239.83.89 port 59376 ssh2
Dec  2 03:04:57 *** sshd[6809]: Failed password for invalid user ls from 145.239.83.89 port 43806 ssh2
Dec  2 03:10:26 *** sshd[6986]: Failed password for invalid user admin fr

2019-12-02T13:29:20.352210+00:00 suse sshd[9214]: Invalid user user from 45.132.194.28 port 52767
2019-12-02T13:29:22.511279+00:00 suse sshd[9214]: error: PAM: User not known to the underlying authentication module for illegal user user from 45.132.194.28
2019-12-02T13:29:20.352210+00:00 suse sshd[9214]: Invalid user user from 45.132.194.28 port 52767
2019-12-02T13:29:22.511279+00:00 suse sshd[9214]: error: PAM: User not known to the underlying authentication module for illegal user user from 45.132.194.28
2019-12-02T13:29:20.352210+00:00 suse sshd[9214]: Invalid user user from 45.132.194.28 port 52767
2019-12-02T13:29:22.511279+00:00 suse sshd[9214]: error: PAM: User not known to the underlying authentication module for illegal user user from 45.132.194.28
2019-12-02T13:29:22.512686+00:00 suse sshd[9214]: Failed keyboard-interactive/pam for invalid user user from 45.132.194.28 port 52767 ssh2
...

Dec  2 22:23:09 vps666546 sshd\[4413\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.68.192  user=root
Dec  2 22:23:11 vps666546 sshd\[4413\]: Failed password for root from 106.12.68.192 port 47034 ssh2
Dec  2 22:30:06 vps666546 sshd\[4675\]: Invalid user giuseppino from 106.12.68.192 port 50006
Dec  2 22:30:06 vps666546 sshd\[4675\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.68.192
Dec  2 22:30:08 vps666546 sshd\[4675\]: Failed password for invalid user giuseppino from 106.12.68.192 port 50006 ssh2
...

SSH auth scanning - multiple failed logins

Dec  2 21:28:37 MK-Soft-VM7 sshd[3344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.173.141 
Dec  2 21:28:39 MK-Soft-VM7 sshd[3344]: Failed password for invalid user ftpuser from 106.13.173.141 port 59080 ssh2
...

2019-12-02T21:38:40.775030hub.schaetter.us sshd\[7173\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.147  user=root
2019-12-02T21:38:42.354144hub.schaetter.us sshd\[7173\]: Failed password for root from 218.92.0.147 port 42877 ssh2
2019-12-02T21:38:45.561724hub.schaetter.us sshd\[7173\]: Failed password for root from 218.92.0.147 port 42877 ssh2
2019-12-02T21:38:48.517662hub.schaetter.us sshd\[7173\]: Failed password for root from 218.92.0.147 port 42877 ssh2
2019-12-02T21:38:52.215721hub.schaetter.us sshd\[7173\]: Failed password for root from 218.92.0.147 port 42877 ssh2
...

Dec221:36:28server2sshd[4355]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec221:36:28server2sshd[4354]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec221:36:28server2sshd[4356]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec221:36:28server2sshd[4357]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec221:36:28server2sshd[4358]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec222:35:36server2sshd[19886]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec222:35:36server2sshd[19885]:refusedconnectfrom218.92.0.137\(218.92.0.137\)Dec222:35:36server2sshd[19887]:refusedconnectfrom218.92.0.137\(218.92.0.137\)

Dec  2 15:31:57 tux-35-217 sshd\[2258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.105.24.95  user=root
Dec  2 15:31:59 tux-35-217 sshd\[2258\]: Failed password for root from 193.105.24.95 port 34979 ssh2
Dec  2 15:38:28 tux-35-217 sshd\[2357\]: Invalid user myth from 193.105.24.95 port 39878
Dec  2 15:38:28 tux-35-217 sshd\[2357\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.105.24.95
...