Jun 30 01:46:18 ny01 sshd[8202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186
Jun 30 01:46:21 ny01 sshd[8202]: Failed password for invalid user gmt from 51.158.108.186 port 54860 ssh2
Jun 30 01:50:19 ny01 sshd[8706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186

Jun  2 07:48:23 MainVPS sshd[12540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Jun  2 07:48:25 MainVPS sshd[12540]: Failed password for root from 51.158.108.186 port 54036 ssh2
Jun  2 07:51:51 MainVPS sshd[15471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Jun  2 07:51:54 MainVPS sshd[15471]: Failed password for root from 51.158.108.186 port 58460 ssh2
Jun  2 07:55:35 MainVPS sshd[18766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Jun  2 07:55:37 MainVPS sshd[18766]: Failed password for root from 51.158.108.186 port 34424 ssh2
...

DATE:2020-05-13 05:59:52, IP:51.158.108.186, PORT:ssh SSH brute force auth (docker-dc)

May  2 14:11:39 raspberrypi sshd\[7796\]: Invalid user admin from 51.158.108.186May  2 14:11:41 raspberrypi sshd\[7796\]: Failed password for invalid user admin from 51.158.108.186 port 39834 ssh2May  2 14:16:36 raspberrypi sshd\[11234\]: Invalid user admin from 51.158.108.186
...

Apr 30 18:43:35 php1 sshd\[15797\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Apr 30 18:43:37 php1 sshd\[15797\]: Failed password for root from 51.158.108.186 port 48324 ssh2
Apr 30 18:47:43 php1 sshd\[16154\]: Invalid user master from 51.158.108.186
Apr 30 18:47:43 php1 sshd\[16154\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186
Apr 30 18:47:46 php1 sshd\[16154\]: Failed password for invalid user master from 51.158.108.186 port 60674 ssh2

May  1 01:04:06 ns382633 sshd\[8510\]: Invalid user admin from 51.158.108.186 port 54770
May  1 01:04:06 ns382633 sshd\[8510\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186
May  1 01:04:08 ns382633 sshd\[8510\]: Failed password for invalid user admin from 51.158.108.186 port 54770 ssh2
May  1 01:16:53 ns382633 sshd\[11005\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
May  1 01:16:55 ns382633 sshd\[11005\]: Failed password for root from 51.158.108.186 port 40946 ssh2

DATE:2020-04-29 18:36:34, IP:51.158.108.186, PORT:ssh SSH brute force auth (docker-dc)

(sshd) Failed SSH login from 51.158.108.186 (FR/France/186-108-158-51.rev.cloud.scaleway.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 27 13:51:43 amsweb01 sshd[28414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Apr 27 13:51:45 amsweb01 sshd[28414]: Failed password for root from 51.158.108.186 port 35134 ssh2
Apr 27 13:56:49 amsweb01 sshd[28993]: Invalid user marius from 51.158.108.186 port 35426
Apr 27 13:56:52 amsweb01 sshd[28993]: Failed password for invalid user marius from 51.158.108.186 port 35426 ssh2
Apr 27 14:00:16 amsweb01 sshd[29463]: Invalid user pav from 51.158.108.186 port 42516

$f2bV_matches

Apr  9 01:08:41 prod4 sshd\[21049\]: Invalid user vagrant from 51.158.108.186
Apr  9 01:08:43 prod4 sshd\[21049\]: Failed password for invalid user vagrant from 51.158.108.186 port 41952 ssh2
Apr  9 01:11:55 prod4 sshd\[21784\]: Invalid user tpgit from 51.158.108.186
...

$f2bV_matches

Invalid user mzk from 51.158.108.186 port 46282

Mar 19 23:43:15 santamaria sshd\[20985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Mar 19 23:43:17 santamaria sshd\[20985\]: Failed password for root from 51.158.108.186 port 35358 ssh2
Mar 19 23:49:18 santamaria sshd\[21163\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
...

Mar 10 11:21:19 yesfletchmain sshd\[1952\]: User root from 51.158.108.186 not allowed because not listed in AllowUsers
Mar 10 11:21:20 yesfletchmain sshd\[1952\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
Mar 10 11:21:21 yesfletchmain sshd\[1952\]: Failed password for invalid user root from 51.158.108.186 port 53012 ssh2
Mar 10 11:28:09 yesfletchmain sshd\[2066\]: User root from 51.158.108.186 not allowed because not listed in AllowUsers
Mar 10 11:28:09 yesfletchmain sshd\[2066\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.108.186  user=root
...

51.158.108.135 - - \[10/Mar/2020:10:20:45 +0100\] "POST /xmlrpc.php HTTP/1.0" 200 738 "-" "Mozilla/5.0 \(Windows NT 6.1\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/59.0.3071.109 Safari/537.36"
51.158.108.135 - - \[10/Mar/2020:10:20:52 +0100\] "POST /xmlrpc.php HTTP/1.0" 200 738 "-" "Mozilla/5.0 \(Windows NT 6.1\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/59.0.3071.109 Safari/537.36"
51.158.108.135 - - \[10/Mar/2020:10:20:58 +0100\] "POST /xmlrpc.php HTTP/1.0" 200 738 "-" "Mozilla/5.0 \(Windows NT 6.1\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/59.0.3071.109 Safari/537.36"

xmlrpc attack

Automatic report - XMLRPC Attack

Automatic report - XMLRPC Attack

Automatic report - Banned IP Access

Nov 14 23:37:05 vpn sshd[8657]: Failed password for root from 175.6.5.52 port 61501 ssh2
Nov 14 23:37:54 vpn sshd[8659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.5.52
Nov 14 23:37:56 vpn sshd[8659]: Failed password for invalid user noc from 175.6.5.52 port 65347 ssh2

\[2019-07-18 17:07:48\] NOTICE\[20804\] chan_sip.c: Registration from '\' failed for '5.62.41.147:8365' - Wrong password
\[2019-07-18 17:07:48\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T17:07:48.528-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3213",SessionID="0x7f06f823f758",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.147/53908",Challenge="5d27b76b",ReceivedChallenge="5d27b76b",ReceivedHash="692d968e0a00e8b1ee4afeedde54d79d"
\[2019-07-18 17:09:06\] NOTICE\[20804\] chan_sip.c: Registration from '\' failed for '5.62.41.147:8272' - Wrong password
\[2019-07-18 17:09:06\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T17:09:06.220-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3214",SessionID="0x7f06f823f758",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.147/5

Mar 10 18:09:48 vpn sshd[29666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.10.141.130
Mar 10 18:09:50 vpn sshd[29666]: Failed password for invalid user usuario from 176.10.141.130 port 47394 ssh2
Mar 10 18:16:37 vpn sshd[29676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.10.141.130

Mar  1 01:21:39 vpn sshd[15135]: Invalid user vyatta from 175.196.209.174
Mar  1 01:21:39 vpn sshd[15135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.196.209.174
Mar  1 01:21:41 vpn sshd[15135]: Failed password for invalid user vyatta from 175.196.209.174 port 55476 ssh2
Mar  1 01:24:44 vpn sshd[15137]: Invalid user ftpuser from 175.196.209.174
Mar  1 01:24:44 vpn sshd[15137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.196.209.174

Apr  7 16:38:57 vpn sshd[19195]: Invalid user pi from 175.193.107.122
Apr  7 16:38:57 vpn sshd[19197]: Invalid user pi from 175.193.107.122
Apr  7 16:38:57 vpn sshd[19195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.193.107.122
Apr  7 16:38:57 vpn sshd[19197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.193.107.122
Apr  7 16:38:58 vpn sshd[19195]: Failed password for invalid user pi from 175.193.107.122 port 34180 ssh2

Mar 10 01:28:16 vpn sshd[1657]: Invalid user invoices from 175.207.13.114
Mar 10 01:28:16 vpn sshd[1657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.207.13.114
Mar 10 01:28:19 vpn sshd[1657]: Failed password for invalid user invoices from 175.207.13.114 port 52326 ssh2
Mar 10 01:30:40 vpn sshd[1660]: Invalid user nvidia from 175.207.13.114
Mar 10 01:30:40 vpn sshd[1660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.207.13.114

Jul 18 23:14:15 bouncer sshd\[30171\]: Invalid user technology from 159.65.245.203 port 56318
Jul 18 23:14:15 bouncer sshd\[30171\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.245.203 
Jul 18 23:14:17 bouncer sshd\[30171\]: Failed password for invalid user technology from 159.65.245.203 port 56318 ssh2
...

Jul 18 23:04:30 legacy sshd[4064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.190.106
Jul 18 23:04:33 legacy sshd[4064]: Failed password for invalid user zt from 45.55.190.106 port 37305 ssh2
Jul 18 23:09:14 legacy sshd[4248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.190.106
...

Jul 18 23:15:53 [munged] sshd[10073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.37.100.247  user=root
Jul 18 23:15:54 [munged] sshd[10073]: Failed password for root from 176.37.100.247 port 34192 ssh2

Jul 18 23:26:32 vps691689 sshd[15184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=136.63.96.92
Jul 18 23:26:35 vps691689 sshd[15184]: Failed password for invalid user test2 from 136.63.96.92 port 42797 ssh2
Jul 18 23:34:21 vps691689 sshd[15312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=136.63.96.92
...

Jul 19 03:27:57 vibhu-HP-Z238-Microtower-Workstation sshd\[19908\]: Invalid user art from 138.197.151.248
Jul 19 03:27:57 vibhu-HP-Z238-Microtower-Workstation sshd\[19908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.151.248
Jul 19 03:27:58 vibhu-HP-Z238-Microtower-Workstation sshd\[19908\]: Failed password for invalid user art from 138.197.151.248 port 50032 ssh2
Jul 19 03:34:15 vibhu-HP-Z238-Microtower-Workstation sshd\[20127\]: Invalid user amber from 138.197.151.248
Jul 19 03:34:15 vibhu-HP-Z238-Microtower-Workstation sshd\[20127\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.151.248
...

Oct  5 06:12:52 vpn sshd[30170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.20.93  user=root
Oct  5 06:12:54 vpn sshd[30170]: Failed password for root from 175.6.20.93 port 36838 ssh2
Oct  5 06:18:35 vpn sshd[30177]: Invalid user asmund from 175.6.20.93
Oct  5 06:18:35 vpn sshd[30177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.20.93
Oct  5 06:18:37 vpn sshd[30177]: Failed password for invalid user asmund from 175.6.20.93 port 45674 ssh2

Dec  9 14:14:23 vpn sshd[22282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.200.104.49
Dec  9 14:14:25 vpn sshd[22282]: Failed password for invalid user test3 from 175.200.104.49 port 54508 ssh2
Dec  9 14:23:22 vpn sshd[22350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.200.104.49

Dec 12 13:57:06 vpn sshd[6739]: Failed password for root from 176.106.65.238 port 48259 ssh2
Dec 12 14:07:01 vpn sshd[6811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.106.65.238
Dec 12 14:07:03 vpn sshd[6811]: Failed password for invalid user ivan from 176.106.65.238 port 52124 ssh2

WordPress login Brute force / Web App Attack on client site.