WordPress wp-login brute force :: 2a02:1630::57 0.132 BYPASS [02/Feb/2020:17:29:04  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

2019-12-06 22:57:40,447 fail2ban.actions: WARNING [ssh] Ban 200.48.214.19

Dec  6 12:22:59 hpm sshd\[8842\]: Invalid user uqfex from 106.13.118.162
Dec  6 12:22:59 hpm sshd\[8842\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.118.162
Dec  6 12:23:01 hpm sshd\[8842\]: Failed password for invalid user uqfex from 106.13.118.162 port 40198 ssh2
Dec  6 12:29:47 hpm sshd\[9495\]: Invalid user rogler from 106.13.118.162
Dec  6 12:29:47 hpm sshd\[9495\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.118.162

Dec  6 23:56:28 herz-der-gamer sshd[13542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.163  user=root
Dec  6 23:56:30 herz-der-gamer sshd[13542]: Failed password for root from 222.186.175.163 port 50070 ssh2
...

Dec  6 15:22:57 saengerschafter sshd[11132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79-73-63-65.dynamic.dsl.as9105.com  user=r.r
Dec  6 15:23:00 saengerschafter sshd[11132]: Failed password for r.r from 79.73.63.65 port 34411 ssh2
Dec  6 15:23:04 saengerschafter sshd[11132]: message repeated 2 serveres: [ Failed password for r.r from 79.73.63.65 port 34411 ssh2]
Dec  6 15:23:05 saengerschafter sshd[11132]: Failed password for r.r from 79.73.63.65 port 34411 ssh2
Dec  6 15:23:09 saengerschafter sshd[11132]: message repeated 2 serveres: [ Failed password for r.r from 79.73.63.65 port 34411 ssh2]
Dec  6 15:23:09 saengerschafter sshd[11132]: error: maximum authentication attempts exceeded for r.r from 79.73.63.65 port 34411 ssh2 [preauth]
Dec  6 15:23:09 saengerschafter sshd[11132]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=79-73-63-65.dynamic.dsl.as9105.com  user=r.r
Dec  6 15:23:11 saeng........
-------------------------------

Dec  6 12:31:39 auw2 sshd\[4282\]: Invalid user dorney from 139.59.61.134
Dec  6 12:31:39 auw2 sshd\[4282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.61.134
Dec  6 12:31:41 auw2 sshd\[4282\]: Failed password for invalid user dorney from 139.59.61.134 port 43362 ssh2
Dec  6 12:38:05 auw2 sshd\[4997\]: Invalid user player from 139.59.61.134
Dec  6 12:38:05 auw2 sshd\[4997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.61.134

2019-12-06T22:56:36.809382abusebot-6.cloudsearch.cf sshd\[8944\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.81.77  user=root

Dec  6 17:48:14 linuxvps sshd\[60017\]: Invalid user jader from 221.195.189.144
Dec  6 17:48:14 linuxvps sshd\[60017\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.195.189.144
Dec  6 17:48:16 linuxvps sshd\[60017\]: Failed password for invalid user jader from 221.195.189.144 port 37958 ssh2
Dec  6 17:54:05 linuxvps sshd\[63302\]: Invalid user mackel from 221.195.189.144
Dec  6 17:54:05 linuxvps sshd\[63302\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.195.189.144

$f2bV_matches

WordPress XMLRPC scan :: 78.90.100.55 0.132 BYPASS [06/Dec/2019:14:44:24  0000] www.[censored_4] "GET /xmlrpc.php HTTP/1.1" 405 53 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

Dec  6 23:56:23 [host] sshd[27426]: Invalid user wannell from 140.143.59.171
Dec  6 23:56:23 [host] sshd[27426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.59.171
Dec  6 23:56:25 [host] sshd[27426]: Failed password for invalid user wannell from 140.143.59.171 port 46902 ssh2

12/06/2019-23:31:48.478366 34.215.69.55 Protocol: 6 ET POLICY Cleartext WordPress Login

SQL APT Attack
Reported by and Credit to nic@wlink.biz from IP 118.69.71.82

Dec  6 18:32:48 meumeu sshd[1799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.234.170 
Dec  6 18:32:50 meumeu sshd[1799]: Failed password for invalid user student from 27.128.234.170 port 45027 ssh2
Dec  6 18:38:43 meumeu sshd[2838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.234.170 
...

Dec  6 22:27:23 relay postfix/smtpd\[29308\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.140\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  6 22:27:23 relay postfix/smtpd\[29308\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.140\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  6 22:27:23 relay postfix/smtpd\[29308\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.140\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  6 22:27:23 relay postfix/smtpd\[29308\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.140\]: 554 5.7.1 \: Relay access denied\; from=\ to=\

Dec  6 23:56:25 ns3367391 sshd[25345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.116  user=root
Dec  6 23:56:27 ns3367391 sshd[25345]: Failed password for root from 49.88.112.116 port 35766 ssh2
Dec  6 23:56:29 ns3367391 sshd[25345]: Failed password for root from 49.88.112.116 port 35766 ssh2
Dec  6 23:56:25 ns3367391 sshd[25345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.116  user=root
Dec  6 23:56:27 ns3367391 sshd[25345]: Failed password for root from 49.88.112.116 port 35766 ssh2
Dec  6 23:56:29 ns3367391 sshd[25345]: Failed password for root from 49.88.112.116 port 35766 ssh2
...