Jun  2 10:26:17 roki-contabo sshd\[26655\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.124.137.130  user=root
Jun  2 10:26:19 roki-contabo sshd\[26655\]: Failed password for root from 106.124.137.130 port 60880 ssh2
Jun  2 10:48:05 roki-contabo sshd\[26830\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.124.137.130  user=root
Jun  2 10:48:07 roki-contabo sshd\[26830\]: Failed password for root from 106.124.137.130 port 45378 ssh2
Jun  2 10:52:41 roki-contabo sshd\[26884\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.124.137.130  user=root
...

Failed password for invalid user root from 123.232.102.30 port 34154 ssh2

Jun  2 06:00:15 inter-technics sshd[24155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.133.221  user=root
Jun  2 06:00:17 inter-technics sshd[24155]: Failed password for root from 167.172.133.221 port 41814 ssh2
Jun  2 06:02:58 inter-technics sshd[24262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.133.221  user=root
Jun  2 06:03:00 inter-technics sshd[24262]: Failed password for root from 167.172.133.221 port 46874 ssh2
Jun  2 06:05:42 inter-technics sshd[24489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.133.221  user=root
Jun  2 06:05:44 inter-technics sshd[24489]: Failed password for root from 167.172.133.221 port 51936 ssh2
...

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

SSH Brute Force

157.230.27.30 - - [02/Jun/2020:05:49:42 +0200] "GET /wp-login.php HTTP/1.1" 200 6287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.27.30 - - [02/Jun/2020:05:49:48 +0200] "POST /wp-login.php HTTP/1.1" 200 6517 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.27.30 - - [02/Jun/2020:05:49:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

(imapd) Failed IMAP login from 171.103.37.246 (TH/Thailand/171-103-37-246.static.asianet.co.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  2 08:19:38 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 16 secs): user=, method=PLAIN, rip=171.103.37.246, lip=5.63.12.44, session=<0TH8yxGnd4OrZyX2>

Brute forcing RDP port 3389

Jun  2 10:45:52 abendstille sshd\[6376\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.159  user=root
Jun  2 10:45:55 abendstille sshd\[6376\]: Failed password for root from 51.68.226.159 port 57326 ssh2
Jun  2 10:49:20 abendstille sshd\[9674\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.159  user=root
Jun  2 10:49:22 abendstille sshd\[9674\]: Failed password for root from 51.68.226.159 port 33932 ssh2
Jun  2 10:52:52 abendstille sshd\[13290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.159  user=root
...

Jun  2 06:23:36 inter-technics sshd[25949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.87.158.98  user=root
Jun  2 06:23:38 inter-technics sshd[25949]: Failed password for root from 177.87.158.98 port 45358 ssh2
Jun  2 06:27:56 inter-technics sshd[7831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.87.158.98  user=root
Jun  2 06:27:58 inter-technics sshd[7831]: Failed password for root from 177.87.158.98 port 50508 ssh2
Jun  2 06:32:23 inter-technics sshd[11106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.87.158.98  user=root
Jun  2 06:32:25 inter-technics sshd[11106]: Failed password for root from 177.87.158.98 port 55692 ssh2
...

Jun  2 10:00:46 ns382633 sshd\[31678\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.238.205  user=root
Jun  2 10:00:49 ns382633 sshd\[31678\]: Failed password for root from 51.38.238.205 port 39114 ssh2
Jun  2 10:05:47 ns382633 sshd\[32573\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.238.205  user=root
Jun  2 10:05:49 ns382633 sshd\[32573\]: Failed password for root from 51.38.238.205 port 47175 ssh2
Jun  2 10:09:41 ns382633 sshd\[610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.238.205  user=root

DATE:2020-06-02 07:51:52, IP:123.125.194.150, PORT:ssh SSH brute force auth (docker-dc)

2020-06-02T05:59:56.636477shield sshd\[31210\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.140.83  user=root
2020-06-02T05:59:58.958947shield sshd\[31210\]: Failed password for root from 106.13.140.83 port 60024 ssh2
2020-06-02T06:02:23.740087shield sshd\[31584\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.140.83  user=root
2020-06-02T06:02:25.244367shield sshd\[31584\]: Failed password for root from 106.13.140.83 port 60984 ssh2
2020-06-02T06:04:47.432199shield sshd\[31973\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.140.83  user=root

06/02/2020-04:15:00.948385 87.251.74.140 Protocol: 6 ET SCAN NMAP -sS window 1024

Automatic report - XMLRPC Attack