xmlrpc attack

Mar  3 08:08:01 server sshd\[2931\]: Invalid user admin1 from 1.54.194.202
Mar  3 08:08:01 server sshd\[2931\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.54.194.202 
Mar  3 08:08:03 server sshd\[2931\]: Failed password for invalid user admin1 from 1.54.194.202 port 48444 ssh2
Mar  3 08:53:49 server sshd\[10801\]: Invalid user admin1 from 1.54.194.202
Mar  3 08:53:49 server sshd\[10801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.54.194.202 
...

Mar  3 06:40:53 ns381471 sshd[7648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.119.121
Mar  3 06:40:55 ns381471 sshd[7648]: Failed password for invalid user es from 156.236.119.121 port 59464 ssh2

said spectrum is not

Received: from p-mtain002.msg.pkvw.co.charter.net ([107.14.70.244])
          by dnvrco-fep10.email.rr.com
          (InterMail vM.8.04.03.24 201-2389-100-172-20151028) with ESMTP
          id <20200303033443.HRCX7016.dnvrco-fep10.email.rr.com@p-mtain002.msg.pkvw.co.charter.net>
          for ; Tue, 3 Mar 2020 03:34:43 +0000
Received: from p-impin024.msg.pkvw.co.charter.net ([47.43.26.179])
          by p-mtain002.msg.pkvw.co.charter.net
          (InterMail vM.9.01.00.037.1 201-2473-137-122-172) with ESMTP
          id <20200303033443.NDNZ30089.p-mtain002.msg.pkvw.co.charter.net@p-impin024.msg.pkvw.co.charter.net>
          for ; Tue, 3 Mar 2020 03:34:43 +0000
Received: from p-impout001.msg.pkvw.co.charter.net ([47.43.26.138])
Received: from [127.0.0.1] ([66.18.52.186])
	by cmsmtp with ESMTPA

Mar  3 06:18:00 vps670341 sshd[8844]: Invalid user rpcuser from 45.32.131.193 port 49066

2020-03-03T04:57:54.516201Linux-Server-Pi sshd[11747]: error: maximum authentication attempts exceeded for root from 80.38.210.144 port 60866 ssh2 [preauth]
2020-03-03T04:58:00.583078Linux-Server-Pi sshd[11749]: error: maximum authentication attempts exceeded for root from 80.38.210.144 port 60873 ssh2 [preauth]
2020-03-03T04:58:12.869134Linux-Server-Pi sshd[11753]: Invalid user admin from 80.38.210.144 port 60884
...

Mar  3 06:34:04 MK-Soft-VM4 sshd[25719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.71.191 
Mar  3 06:34:06 MK-Soft-VM4 sshd[25719]: Failed password for invalid user hr from 51.38.71.191 port 41724 ssh2
...

Mar  3 05:58:16 ewelt sshd[21986]: Invalid user ubuntu from 138.68.171.25 port 50450
Mar  3 05:58:16 ewelt sshd[21986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.171.25
Mar  3 05:58:16 ewelt sshd[21986]: Invalid user ubuntu from 138.68.171.25 port 50450
Mar  3 05:58:18 ewelt sshd[21986]: Failed password for invalid user ubuntu from 138.68.171.25 port 50450 ssh2
...

$f2bV_matches

Mar  3 00:54:04 NPSTNNYC01T sshd[23388]: Failed password for gnats from 218.253.69.134 port 34784 ssh2
Mar  3 01:02:43 NPSTNNYC01T sshd[23871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.253.69.134
Mar  3 01:02:45 NPSTNNYC01T sshd[23871]: Failed password for invalid user hubihao from 218.253.69.134 port 32962 ssh2
...

postfix/smtpd\[8795\]: NOQUEUE: reject: RCPT from unknown\[117.87.224.58\]: 554 5.7.1 Service Client host \[117.87.224.58\] blocked using sbl-xbl.spamhaus.org\;

Mar  3 05:57:28 debian-2gb-nbg1-2 kernel: \[5470629.080024\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=129.226.154.67 DST=195.201.40.59 LEN=58 TOS=0x08 PREC=0x00 TTL=235 ID=54321 PROTO=UDP SPT=55294 DPT=69 LEN=38

firewall-block, port(s): 1100/tcp

Mar  3 07:08:58 ArkNodeAT sshd\[31413\]: Invalid user dave from 114.220.76.79
Mar  3 07:08:58 ArkNodeAT sshd\[31413\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.220.76.79
Mar  3 07:08:59 ArkNodeAT sshd\[31413\]: Failed password for invalid user dave from 114.220.76.79 port 47170 ssh2

93.174.93.195 was recorded 25 times by 14 hosts attempting to connect to the following ports: 65024,65476,65534. Incident counter (4h, 24h, all-time): 25, 173, 7486

Honeypot attack, port: 445, PTR: host22-226-static.44-85-b.business.telecomitalia.it.