xmlrpc attack

2020-08-18 07:19:08.461592-0500  localhost smtpd[73314]: NOQUEUE: reject: RCPT from e244058.upc-e.chello.nl[213.93.244.58]: 554 5.7.1 Service unavailable; Client host [213.93.244.58] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/213.93.244.58; from= to= proto=ESMTP helo=

Aug 18 12:27:30 ip-172-31-16-56 sshd\[21580\]: Invalid user user from 178.128.61.101\
Aug 18 12:27:32 ip-172-31-16-56 sshd\[21580\]: Failed password for invalid user user from 178.128.61.101 port 47588 ssh2\
Aug 18 12:30:05 ip-172-31-16-56 sshd\[21592\]: Failed password for root from 178.128.61.101 port 55314 ssh2\
Aug 18 12:32:35 ip-172-31-16-56 sshd\[21634\]: Invalid user cwu from 178.128.61.101\
Aug 18 12:32:37 ip-172-31-16-56 sshd\[21634\]: Failed password for invalid user cwu from 178.128.61.101 port 34806 ssh2\

SSH login attempts.

xmlrpc attack

Aug 18 09:23:57 ny01 sshd[9263]: Failed password for root from 132.232.68.26 port 56394 ssh2
Aug 18 09:30:48 ny01 sshd[10911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.68.26
Aug 18 09:30:50 ny01 sshd[10911]: Failed password for invalid user cwm from 132.232.68.26 port 37556 ssh2

2020-08-18T22:24:00.566816hostname sshd[4119]: Invalid user ftpuser from 51.91.108.87 port 47334
2020-08-18T22:24:02.274591hostname sshd[4119]: Failed password for invalid user ftpuser from 51.91.108.87 port 47334 ssh2
2020-08-18T22:24:09.551521hostname sshd[4243]: Invalid user ftpuser from 51.91.108.87 port 45662
...

Unauthorized connection attempt from IP address 197.31.66.211 on Port 445(SMB)

srvr3: (mod_security) mod_security (id:920350) triggered by 119.18.155.26 (ID/Indonesia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/18 14:32:24 [error] 192926#0: *17358 [client 119.18.155.26] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host'  [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159775394489.483433"] [ref "o0,17v21,17"], client: 119.18.155.26, [redacted] request: "GET / HTTP/1.1" [redacted]

Aug 18 17:46:47 abendstille sshd\[4270\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.14.224  user=root
Aug 18 17:46:49 abendstille sshd\[4270\]: Failed password for root from 182.61.14.224 port 39592 ssh2
Aug 18 17:50:09 abendstille sshd\[7528\]: Invalid user user from 182.61.14.224
Aug 18 17:50:09 abendstille sshd\[7528\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.14.224
Aug 18 17:50:11 abendstille sshd\[7528\]: Failed password for invalid user user from 182.61.14.224 port 44774 ssh2
...

Unauthorized connection attempt from IP address 36.74.46.104 on Port 445(SMB)

Banned for a week because repeated abuses, for example SSH, but not only

18.08.2020 16:08:01 SSH access blocked by firewall

Aug 18 14:59:00 electroncash sshd[25119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Aug 18 14:59:00 electroncash sshd[25119]: Invalid user webadm from 167.114.12.244 port 60420
Aug 18 14:59:02 electroncash sshd[25119]: Failed password for invalid user webadm from 167.114.12.244 port 60420 ssh2
Aug 18 15:02:52 electroncash sshd[27292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244  user=root
Aug 18 15:02:53 electroncash sshd[27292]: Failed password for root from 167.114.12.244 port 41426 ssh2
...

0,17-03/10 [bc02/m35] PostRequest-Spammer scoring: zurich

URL Probing: /wp-login.php