Wordpress framework attack - soft filter

62.210.205.141 - - [04/Oct/2020:10:30:30 +0200] "POST /wp-login.php HTTP/1.1" 200 15469 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [04/Oct/2020:10:30:31 +0200] "POST /wp-login.php HTTP/1.1" 200 15469 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [04/Oct/2020:10:30:32 +0200] "POST /wp-login.php HTTP/1.1" 200 15469 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [04/Oct/2020:10:30:34 +0200] "POST /wp-login.php HTTP/1.1" 200 15469 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [04/Oct/2020:10:3
...

Automatic report - WordPress Brute Force

Automatic report - WordPress Brute Force

Attempt to log in with non-existing username: admin

62.210.205.141 - - [08/Jun/2020:18:13:40 +0100] "POST /wp-login.php HTTP/1.1" 200 6669 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [08/Jun/2020:18:13:41 +0100] "POST /wp-login.php HTTP/1.1" 200 6669 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [08/Jun/2020:18:13:42 +0100] "POST /wp-login.php HTTP/1.1" 200 6662 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
...

62.210.205.141 - - [05/Jun/2020:15:08:55 +0200] "POST /wp-login.php HTTP/1.1" 200 9371 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
62.210.205.141 - - [05/Jun/2020:15:08:55 +0200] "POST /wp-login.php HTTP/1.1" 200 9371 "http://cubscouts.org/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
...

Automatic report - WordPress Brute Force

Automatic report - WordPress Brute Force

DDoS

Oct  3 17:01:29 roki-contabo sshd\[11951\]: Invalid user usuario from 62.210.205.60
Oct  3 17:01:29 roki-contabo sshd\[11951\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.205.60
Oct  3 17:01:30 roki-contabo sshd\[11951\]: Failed password for invalid user usuario from 62.210.205.60 port 54448 ssh2
Oct  3 17:09:59 roki-contabo sshd\[12123\]: Invalid user ftpuser from 62.210.205.60
Oct  3 17:09:59 roki-contabo sshd\[12123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.205.60
...

Oct  4 16:09:03 vps639187 sshd\[23898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.205.60  user=root
Oct  4 16:09:05 vps639187 sshd\[23898\]: Failed password for root from 62.210.205.60 port 56122 ssh2
Oct  4 16:12:34 vps639187 sshd\[23956\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.205.60  user=root
...

Invalid user usrlib from 62.210.205.60 port 42504

WordPress (CMS) attack attempts.
Date: 2020 Aug 11. 11:41:52
Source IP: 62.210.205.76

Portion of the log(s):
62.210.205.76 - [11/Aug/2020:11:41:49 +0200] "GET /wp-login.php HTTP/1.1" 200 1962 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
62.210.205.76 - [11/Aug/2020:11:41:49 +0200] "POST /wp-login.php HTTP/1.1" 200 2419 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
62.210.205.76 - [11/Aug/2020:11:41:49 +0200] "POST /xmlrpc.php HTTP/1.1" 404 118 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Jun 29 21:49:42 [host] sshd[6480]: Invalid user vl
Jun 29 21:49:42 [host] sshd[6480]: pam_unix(sshd:a
Jun 29 21:49:44 [host] sshd[6480]: Failed password

SSH Brute-Forcing (server1)

May 29 23:23:05 ns381471 sshd[15833]: Failed password for root from 62.210.205.155 port 59028 ssh2

May 28 08:04:16 vserver sshd\[6044\]: Failed password for root from 62.210.205.155 port 38063 ssh2May 28 08:07:40 vserver sshd\[6090\]: Invalid user java from 62.210.205.155May 28 08:07:42 vserver sshd\[6090\]: Failed password for invalid user java from 62.210.205.155 port 40948 ssh2May 28 08:11:13 vserver sshd\[6156\]: Failed password for root from 62.210.205.155 port 43848 ssh2
...

May 26 18:48:38 vps sshd[400524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62-210-205-155.rev.poneytelecom.eu  user=root
May 26 18:48:40 vps sshd[400524]: Failed password for root from 62.210.205.155 port 56429 ssh2
May 26 18:52:10 vps sshd[417281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62-210-205-155.rev.poneytelecom.eu  user=root
May 26 18:52:12 vps sshd[417281]: Failed password for root from 62.210.205.155 port 59147 ssh2
May 26 18:55:51 vps sshd[434139]: Invalid user sympa from 62.210.205.155 port 33492
...

May  3 00:07:06 vserver sshd\[25245\]: Failed password for root from 62.210.205.155 port 42122 ssh2May  3 00:10:38 vserver sshd\[25298\]: Failed password for root from 62.210.205.155 port 48019 ssh2May  3 00:14:04 vserver sshd\[25317\]: Invalid user admin from 62.210.205.155May  3 00:14:06 vserver sshd\[25317\]: Failed password for invalid user admin from 62.210.205.155 port 53907 ssh2
...

10 failed SSH/Telnet login attempts between 2020-05-01T22:41:04Z and 2020-05-01T23:13:24Z

Invalid user ehkwon from 62.210.205.155 port 34224

2020-04-26T11:34:35.255258mail.thespaminator.com sshd[18446]: Invalid user xxx from 62.210.205.155 port 44865
2020-04-26T11:34:37.108000mail.thespaminator.com sshd[18446]: Failed password for invalid user xxx from 62.210.205.155 port 44865 ssh2
...

Apr 16 17:38:50 gw1 sshd[31306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.205.155
Apr 16 17:38:53 gw1 sshd[31306]: Failed password for invalid user root1 from 62.210.205.155 port 35369 ssh2
...

/wp-login.php

Nov 26 00:43:34 www sshd\[53713\]: Failed password for root from 45.171.196.248 port 38000 ssh2Nov 26 00:43:53 www sshd\[53715\]: Failed password for root from 45.171.196.248 port 38011 ssh2Nov 26 00:44:13 www sshd\[53720\]: Failed password for root from 45.171.196.248 port 38024 ssh2
...

port scan and connect, tcp 3128 (squid-http)

Nov 25 15:02:49 tdfoods sshd\[32249\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.114  user=root
Nov 25 15:02:51 tdfoods sshd\[32249\]: Failed password for root from 49.88.112.114 port 55217 ssh2
Nov 25 15:02:54 tdfoods sshd\[32249\]: Failed password for root from 49.88.112.114 port 55217 ssh2
Nov 25 15:02:56 tdfoods sshd\[32249\]: Failed password for root from 49.88.112.114 port 55217 ssh2
Nov 25 15:03:37 tdfoods sshd\[32330\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.114  user=root

Attempt to attack host OS, exploiting network vulnerabilities, on 26-11-2019 04:55:27.

Nov 26 01:29:20 server sshd\[1219\]: Invalid user longshaw from 59.63.208.54
Nov 26 01:29:20 server sshd\[1219\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.63.208.54 
Nov 26 01:29:22 server sshd\[1219\]: Failed password for invalid user longshaw from 59.63.208.54 port 59022 ssh2
Nov 26 01:44:13 server sshd\[4990\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.63.208.54  user=root
Nov 26 01:44:15 server sshd\[4990\]: Failed password for root from 59.63.208.54 port 45144 ssh2
...

Nov 26 04:55:24 venus sshd\[10416\]: Invalid user wwwadmin from 185.62.85.150 port 43440
Nov 26 04:55:24 venus sshd\[10416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.62.85.150
Nov 26 04:55:26 venus sshd\[10416\]: Failed password for invalid user wwwadmin from 185.62.85.150 port 43440 ssh2
...

Nov 26 06:05:01 vibhu-HP-Z238-Microtower-Workstation sshd\[27375\]: Invalid user maragay from 216.158.229.90
Nov 26 06:05:01 vibhu-HP-Z238-Microtower-Workstation sshd\[27375\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.158.229.90
Nov 26 06:05:02 vibhu-HP-Z238-Microtower-Workstation sshd\[27375\]: Failed password for invalid user maragay from 216.158.229.90 port 60766 ssh2
Nov 26 06:10:59 vibhu-HP-Z238-Microtower-Workstation sshd\[27723\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.158.229.90  user=root
Nov 26 06:11:02 vibhu-HP-Z238-Microtower-Workstation sshd\[27723\]: Failed password for root from 216.158.229.90 port 45886 ssh2
...

Nov 26 06:55:24 ncomp sshd[8401]: Invalid user storm from 145.249.105.204
Nov 26 06:55:24 ncomp sshd[8401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.249.105.204
Nov 26 06:55:24 ncomp sshd[8401]: Invalid user storm from 145.249.105.204
Nov 26 06:55:25 ncomp sshd[8401]: Failed password for invalid user storm from 145.249.105.204 port 34912 ssh2

Attempt to attack host OS, exploiting network vulnerabilities, on 26-11-2019 04:55:26.

firewall-block, port(s): 34004/tcp, 34043/tcp, 34108/tcp, 34123/tcp, 34167/tcp, 34177/tcp, 34201/tcp, 34476/tcp, 34487/tcp, 34570/tcp, 34774/tcp, 34935/tcp

Nov 26 02:22:30 microserver sshd[54964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.137.58
Nov 26 02:22:31 microserver sshd[54964]: Failed password for invalid user bergeson from 49.235.137.58 port 37984 ssh2
Nov 26 02:27:56 microserver sshd[55652]: Invalid user borgar from 49.235.137.58 port 41758
Nov 26 02:27:56 microserver sshd[55652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.137.58
Nov 26 02:40:07 microserver sshd[57352]: Invalid user seenivasa from 49.235.137.58 port 52816
Nov 26 02:40:07 microserver sshd[57352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.137.58
Nov 26 02:40:09 microserver sshd[57352]: Failed password for invalid user seenivasa from 49.235.137.58 port 52816 ssh2
Nov 26 02:44:17 microserver sshd[57783]: Invalid user admin from 49.235.137.58 port 56512
Nov 26 02:44:17 microserver sshd[57783]: pam_unix(sshd:auth): authentication failur

Nov 25 16:08:09 izar postfix/smtpd[19585]: warning: hostname 124-24-200-109.rackcentre.redstation.net.uk does not resolve to address 109.200.24.124
Nov 25 16:08:09 izar postfix/smtpd[19585]: connect from unknown[109.200.24.124]
Nov 25 16:08:09 izar postfix/smtpd[19585]: warning: unknown[109.200.24.124]: SASL LOGIN authentication failed: authentication failure
Nov 25 16:08:09 izar postfix/smtpd[19585]: lost connection after AUTH from unknown[109.200.24.124]
Nov 25 16:08:09 izar postfix/smtpd[19585]: disconnect from unknown[109.200.24.124]
Nov 25 16:08:09 izar postfix/smtpd[19585]: warning: hostname 124-24-200-109.rackcentre.redstation.net.uk does not resolve to address 109.200.24.124
Nov 25 16:08:09 izar postfix/smtpd[19585]: connect from unknown[109.200.24.124]
Nov 25 16:08:09 izar postfix/smtpd[19585]: warning: unknown[109.200.24.124]: SASL LOGIN authentication failed: authentication failure
Nov 25 16:08:09 izar postfix/smtpd[19585]: lost connection after AUTH from unk........
-------------------------------

Nov 26 02:10:28 vmanager6029 sshd\[6064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.175  user=root
Nov 26 02:10:30 vmanager6029 sshd\[6064\]: Failed password for root from 218.92.0.175 port 7463 ssh2
Nov 26 02:10:34 vmanager6029 sshd\[6064\]: Failed password for root from 218.92.0.175 port 7463 ssh2

Nov 26 00:34:02 microserver sshd[40115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.77.145.34  user=root
Nov 26 00:34:04 microserver sshd[40115]: Failed password for root from 41.77.145.34 port 11650 ssh2
Nov 26 00:43:07 microserver sshd[41417]: Invalid user sastri from 41.77.145.34 port 9281
Nov 26 00:43:07 microserver sshd[41417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.77.145.34
Nov 26 00:43:09 microserver sshd[41417]: Failed password for invalid user sastri from 41.77.145.34 port 9281 ssh2
Nov 26 00:56:06 microserver sshd[43314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.77.145.34  user=backup
Nov 26 00:56:09 microserver sshd[43314]: Failed password for backup from 41.77.145.34 port 7993 ssh2
Nov 26 01:00:26 microserver sshd[43913]: Invalid user hoshino from 41.77.145.34 port 7254
Nov 26 01:00:26 microserver sshd[43913]: pam_unix(sshd:auth): authentication fai