Automatic report - XMLRPC Attack

LGS,WP GET /wp-login.php

51.75.201.142:43717 - - [25/Dec/2019:20:29:39 +0100] "GET /test/wp-login.php HTTP/1.1" 404 302

Brute forcing Wordpress login

May 22 23:22:55 meumeu sshd[147049]: Invalid user qhg from 51.75.201.137 port 38586
May 22 23:22:55 meumeu sshd[147049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137 
May 22 23:22:55 meumeu sshd[147049]: Invalid user qhg from 51.75.201.137 port 38586
May 22 23:22:57 meumeu sshd[147049]: Failed password for invalid user qhg from 51.75.201.137 port 38586 ssh2
May 22 23:25:25 meumeu sshd[147397]: Invalid user bvr from 51.75.201.137 port 57104
May 22 23:25:25 meumeu sshd[147397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137 
May 22 23:25:25 meumeu sshd[147397]: Invalid user bvr from 51.75.201.137 port 57104
May 22 23:25:26 meumeu sshd[147397]: Failed password for invalid user bvr from 51.75.201.137 port 57104 ssh2
May 22 23:27:50 meumeu sshd[147764]: Invalid user ole from 51.75.201.137 port 47390
...

$f2bV_matches

2020-05-11T07:38:35.0260061495-001 sshd[18175]: Failed password for invalid user admin from 51.75.201.137 port 60874 ssh2
2020-05-11T07:42:37.7723981495-001 sshd[18379]: Invalid user wwwdata from 51.75.201.137 port 43078
2020-05-11T07:42:37.7754811495-001 sshd[18379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.ip-51-75-201.eu
2020-05-11T07:42:37.7723981495-001 sshd[18379]: Invalid user wwwdata from 51.75.201.137 port 43078
2020-05-11T07:42:39.3651091495-001 sshd[18379]: Failed password for invalid user wwwdata from 51.75.201.137 port 43078 ssh2
2020-05-11T07:46:43.6594721495-001 sshd[18591]: Invalid user smartworldmss from 51.75.201.137 port 53526
...

SSH brutforce

May 10 03:52:59 ip-172-31-61-156 sshd[7178]: Failed password for invalid user zabbix from 51.75.201.28 port 47580 ssh2
May 10 03:52:57 ip-172-31-61-156 sshd[7178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.28
May 10 03:52:57 ip-172-31-61-156 sshd[7178]: Invalid user zabbix from 51.75.201.28
May 10 03:52:59 ip-172-31-61-156 sshd[7178]: Failed password for invalid user zabbix from 51.75.201.28 port 47580 ssh2
May 10 03:56:31 ip-172-31-61-156 sshd[7299]: Invalid user debbie from 51.75.201.28
...

May  7 21:15:12 Ubuntu-1404-trusty-64-minimal sshd\[21270\]: Invalid user bot from 51.75.201.137
May  7 21:15:12 Ubuntu-1404-trusty-64-minimal sshd\[21270\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137
May  7 21:15:14 Ubuntu-1404-trusty-64-minimal sshd\[21270\]: Failed password for invalid user bot from 51.75.201.137 port 50684 ssh2
May  7 21:19:10 Ubuntu-1404-trusty-64-minimal sshd\[23072\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137  user=root
May  7 21:19:12 Ubuntu-1404-trusty-64-minimal sshd\[23072\]: Failed password for root from 51.75.201.137 port 55828 ssh2

May  5 12:12:46 piServer sshd[14496]: Failed password for root from 51.75.201.137 port 46774 ssh2
May  5 12:16:21 piServer sshd[14774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137 
May  5 12:16:23 piServer sshd[14774]: Failed password for invalid user arjun from 51.75.201.137 port 55280 ssh2
...

May  4 14:53:36 PorscheCustomer sshd[21463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.28
May  4 14:53:38 PorscheCustomer sshd[21463]: Failed password for invalid user hannah from 51.75.201.28 port 53490 ssh2
May  4 14:57:32 PorscheCustomer sshd[21618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.28
...

Invalid user gk from 51.75.201.28 port 43918

Apr 26 13:17:57 vpn01 sshd[11690]: Failed password for root from 51.75.201.137 port 60074 ssh2
Apr 26 13:22:05 vpn01 sshd[11787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137
...

Bruteforce detected by fail2ban

Apr 21 23:20:51 vpn01 sshd[24000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.201.137
Apr 21 23:20:53 vpn01 sshd[24000]: Failed password for invalid user test1 from 51.75.201.137 port 44986 ssh2
...

$f2bV_matches

2020-04-16T16:57:00.830114sd-86998 sshd[463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.ip-51-75-201.eu  user=root
2020-04-16T16:57:03.164939sd-86998 sshd[463]: Failed password for root from 51.75.201.137 port 45630 ssh2
2020-04-16T17:00:25.461424sd-86998 sshd[1018]: Invalid user proxy from 51.75.201.137 port 52342
2020-04-16T17:00:25.466446sd-86998 sshd[1018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.ip-51-75-201.eu
2020-04-16T17:00:25.461424sd-86998 sshd[1018]: Invalid user proxy from 51.75.201.137 port 52342
2020-04-16T17:00:27.279390sd-86998 sshd[1018]: Failed password for invalid user proxy from 51.75.201.137 port 52342 ssh2
...

SSH invalid-user multiple login try

web-1 [ssh_2] SSH Attack

Honeypot attack, port: 445, PTR: 177-106-017-158.xd-dynamic.algarnetsuper.com.br.

Nov  5 11:36:59 cp sshd[10296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.87.24

Nov  5 02:23:37 lanister sshd[24037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.116.12.217  user=root
Nov  5 02:23:39 lanister sshd[24037]: Failed password for root from 201.116.12.217 port 42483 ssh2
Nov  5 02:28:29 lanister sshd[24086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.116.12.217  user=root
Nov  5 02:28:31 lanister sshd[24086]: Failed password for root from 201.116.12.217 port 33770 ssh2
...

Nov  5 07:24:16 nextcloud sshd\[19983\]: Invalid user Ionutz from 106.38.76.156
Nov  5 07:24:16 nextcloud sshd\[19983\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.38.76.156
Nov  5 07:24:18 nextcloud sshd\[19983\]: Failed password for invalid user Ionutz from 106.38.76.156 port 41515 ssh2
...

Nov  5 11:20:46 localhost sshd\[129801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.239.106  user=root
Nov  5 11:20:48 localhost sshd\[129801\]: Failed password for root from 188.166.239.106 port 52794 ssh2
Nov  5 11:25:32 localhost sshd\[129962\]: Invalid user rabe from 188.166.239.106 port 43642
Nov  5 11:25:33 localhost sshd\[129962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.239.106
Nov  5 11:25:34 localhost sshd\[129962\]: Failed password for invalid user rabe from 188.166.239.106 port 43642 ssh2
...

ssh failed login

Automatic report - Banned IP Access

2019-11-05T12:21:41.350395mail01 postfix/smtpd[13126]: warning: unknown[45.82.153.76]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-11-05T12:22:04.329991mail01 postfix/smtpd[12459]: warning: unknown[45.82.153.76]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-11-05T12:22:44.288523mail01 postfix/smtpd[31319]: warning: unknown[45.82.153.76]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

2019-11-05T03:28:30.379390MailD postfix/smtpd[11680]: NOQUEUE: reject: RCPT from smtp03.inteligo.pl[193.109.225.250]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
2019-11-05T07:17:12.457740MailD postfix/smtpd[28381]: NOQUEUE: reject: RCPT from smtp03.inteligo.pl[193.109.225.250]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
2019-11-05T07:24:13.255679MailD postfix/smtpd[28952]: NOQUEUE: reject: RCPT from smtp03.inteligo.pl[193.109.225.250]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=

2019-11-05T11:11:01.851173abusebot-3.cloudsearch.cf sshd\[28100\]: Invalid user cliente1 from 185.74.4.189 port 44250

Honeypot attack, port: 445, PTR: PTR record not found

Nov  4 21:55:12 server2 sshd[17722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93-43-76-70.ip91.fastwebnet.hostname  user=r.r
Nov  4 21:55:14 server2 sshd[17722]: Failed password for r.r from 93.43.76.70 port 45252 ssh2
Nov  4 21:55:14 server2 sshd[17722]: Received disconnect from 93.43.76.70: 11: Bye Bye [preauth]
Nov  4 22:25:22 server2 sshd[20948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93-43-76-70.ip91.fastwebnet.hostname  user=r.r
Nov  4 22:25:24 server2 sshd[20948]: Failed password for r.r from 93.43.76.70 port 45968 ssh2
Nov  4 22:25:24 server2 sshd[20948]: Received disconnect from 93.43.76.70: 11: Bye Bye [preauth]
Nov  4 22:43:53 server2 sshd[22278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93-43-76-70.ip91.fastwebnet.hostname  user=r.r
Nov  4 22:43:55 server2 sshd[22278]: Failed password for r.r from 93.43.76.70 port 380........
-------------------------------

Nov  5 12:15:10 vps666546 sshd\[12786\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.23.54.233  user=root
Nov  5 12:15:12 vps666546 sshd\[12786\]: Failed password for root from 5.23.54.233 port 38882 ssh2
Nov  5 12:19:01 vps666546 sshd\[12892\]: Invalid user soeun from 5.23.54.233 port 50460
Nov  5 12:19:01 vps666546 sshd\[12892\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.23.54.233
Nov  5 12:19:04 vps666546 sshd\[12892\]: Failed password for invalid user soeun from 5.23.54.233 port 50460 ssh2
...

Nov  4 05:32:51 lamijardin sshd[2767]: Did not receive identification string from 144.217.169.90
Nov  4 05:40:54 lamijardin sshd[2848]: Invalid user ntps from 144.217.169.90
Nov  4 05:40:54 lamijardin sshd[2848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.169.90
Nov  4 05:40:56 lamijardin sshd[2848]: Failed password for invalid user ntps from 144.217.169.90 port 60816 ssh2
Nov  4 05:40:56 lamijardin sshd[2848]: Received disconnect from 144.217.169.90 port 60816:11: Normal Shutdown, Thank you for playing [preauth]
Nov  4 05:40:56 lamijardin sshd[2848]: Disconnected from 144.217.169.90 port 60816 [preauth]
Nov  4 05:50:16 lamijardin sshd[2863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.169.90  user=r.r
Nov  4 05:50:18 lamijardin sshd[2863]: Failed password for r.r from 144.217.169.90 port 36980 ssh2
Nov  4 05:50:18 lamijardin sshd[2863]: Received disconnect from 144.........
-------------------------------