Microsoft Windows Terminal server RDP over non-standard port attempt - 235

Nov  6 06:17:00 ip-172-31-62-245 sshd\[25063\]: Invalid user koln from 49.235.35.12\
Nov  6 06:17:02 ip-172-31-62-245 sshd\[25063\]: Failed password for invalid user koln from 49.235.35.12 port 60738 ssh2\
Nov  6 06:21:27 ip-172-31-62-245 sshd\[25111\]: Invalid user changem from 49.235.35.12\
Nov  6 06:21:30 ip-172-31-62-245 sshd\[25111\]: Failed password for invalid user changem from 49.235.35.12 port 60318 ssh2\
Nov  6 06:25:27 ip-172-31-62-245 sshd\[25185\]: Invalid user luanvandiemcao from 49.235.35.12\

$f2bV_matches

Nov  6 03:58:15 plusreed sshd[12473]: Invalid user www from 138.197.145.26
...

Nov  6 00:23:53 auw2 sshd\[12603\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.27.104  user=root
Nov  6 00:23:55 auw2 sshd\[12603\]: Failed password for root from 139.59.27.104 port 48768 ssh2
Nov  6 00:27:58 auw2 sshd\[12953\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.27.104  user=root
Nov  6 00:28:00 auw2 sshd\[12953\]: Failed password for root from 139.59.27.104 port 58926 ssh2
Nov  6 00:32:02 auw2 sshd\[13282\]: Invalid user user from 139.59.27.104
Nov  6 00:32:02 auw2 sshd\[13282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.27.104

19/11/6@02:42:15: FAIL: IoT-SSH address from=167.99.203.202
...

2019-11-06T08:21:37.008835host3.slimhost.com.ua sshd[3968902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.66.77.230
2019-11-06T08:21:37.003288host3.slimhost.com.ua sshd[3968902]: Invalid user usuario from 80.66.77.230 port 53130
2019-11-06T08:21:38.844124host3.slimhost.com.ua sshd[3968902]: Failed password for invalid user usuario from 80.66.77.230 port 53130 ssh2
2019-11-06T08:25:27.221106host3.slimhost.com.ua sshd[3971820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.66.77.230  user=root
2019-11-06T08:25:29.628819host3.slimhost.com.ua sshd[3971820]: Failed password for root from 80.66.77.230 port 34646 ssh2
...

(From edfreeman231@gmail.com) Hello there! 

I'm a freelance online marketer who's seeking new clients interested in getting more traffic to their websites. Can you please help me out a bit? I'd like to speak to the person in your company who is in charge on managing the website, and I would really appreciate it if you could forward this message to them and have them respond to me. 

If you're in need of SEO, I can assist you for a cheap cost. I've been a freelance search engine optimization specialist for 10 years and can get your site up where you need it to be. Boosting your ranking in search engines can progressively increase the amount of traffic you get in your site. Even just having high placements on Google alone for specific keywords relating to your business can really boost your sales. 

I'd like to help your company progress to the next level. Please write back to let me know if you're interested and I'll provide you with a free consultation and pricing on my services. I hope to speak with y

Nov  5 07:51:37 mx01 sshd[4581]: Invalid user test from 62.234.145.195
Nov  5 07:51:37 mx01 sshd[4581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.145.195 
Nov  5 07:51:39 mx01 sshd[4581]: Failed password for invalid user test from 62.234.145.195 port 47030 ssh2
Nov  5 07:51:39 mx01 sshd[4581]: Received disconnect from 62.234.145.195: 11: Bye Bye [preauth]
Nov  5 08:01:26 mx01 sshd[5717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.145.195  user=r.r
Nov  5 08:01:28 mx01 sshd[5717]: Failed password for r.r from 62.234.145.195 port 46968 ssh2
Nov  5 08:01:28 mx01 sshd[5717]: Received disconnect from 62.234.145.195: 11: Bye Bye [preauth]
Nov  5 08:07:19 mx01 sshd[6296]: Invalid user io from 62.234.145.195
Nov  5 08:07:19 mx01 sshd[6296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.145.195 
Nov  5 08:07:21 mx01 sshd[6296]:........
-------------------------------

Nov  6 11:32:00 h2177944 sshd\[19638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.81.109  user=root
Nov  6 11:32:02 h2177944 sshd\[19638\]: Failed password for root from 123.206.81.109 port 47014 ssh2
Nov  6 11:37:55 h2177944 sshd\[19905\]: Invalid user usuario from 123.206.81.109 port 54788
Nov  6 11:37:55 h2177944 sshd\[19905\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.81.109
...

Nov  6 10:48:26 minden010 sshd[1750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.33.45.156
Nov  6 10:48:29 minden010 sshd[1750]: Failed password for invalid user kim1968 from 178.33.45.156 port 54398 ssh2
Nov  6 10:52:07 minden010 sshd[3117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.33.45.156
...

From: ELENA  (I dont know exactly where to begin)

B: /wp-login.php attack

Nov  5 21:59:15 sachi sshd\[27920\]: Invalid user tyty520 from 62.110.66.66
Nov  5 21:59:15 sachi sshd\[27920\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host66-66-static.110-62-b.business.telecomitalia.it
Nov  5 21:59:17 sachi sshd\[27920\]: Failed password for invalid user tyty520 from 62.110.66.66 port 37454 ssh2
Nov  5 22:04:11 sachi sshd\[28328\]: Invalid user asdQWERTY from 62.110.66.66
Nov  5 22:04:11 sachi sshd\[28328\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host66-66-static.110-62-b.business.telecomitalia.it

WordPress XMLRPC scan :: 5.135.129.180 0.236 BYPASS [06/Nov/2019:10:30:41  0000] [censored_4] "GET /xmlrpc.php HTTP/1.1" 405 53 "http://[censored_4]/xmlrpc.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"