WordPress login Brute force / Web App Attack on client site.

xmlrpc attack

C1,WP GET /nelson/wp-login.php

Mar  5 20:35:20 lcl-usvr-02 sshd[9129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.83.204  user=root
Mar  5 20:35:22 lcl-usvr-02 sshd[9129]: Failed password for root from 178.128.83.204 port 57102 ssh2
Mar  5 20:35:35 lcl-usvr-02 sshd[9182]: Invalid user test from 178.128.83.204 port 59742
...

2020-03-05T11:47:56.314116vps773228.ovh.net sshd[15671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
2020-03-05T11:47:59.060263vps773228.ovh.net sshd[15671]: Failed password for root from 222.186.31.83 port 40432 ssh2
2020-03-05T11:48:01.090463vps773228.ovh.net sshd[15671]: Failed password for root from 222.186.31.83 port 40432 ssh2
2020-03-05T14:24:50.130813vps773228.ovh.net sshd[18581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
2020-03-05T14:24:52.589451vps773228.ovh.net sshd[18581]: Failed password for root from 222.186.31.83 port 60047 ssh2
2020-03-05T14:24:50.130813vps773228.ovh.net sshd[18581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
2020-03-05T14:24:52.589451vps773228.ovh.net sshd[18581]: Failed password for root from 222.186.31.83 port 60047 ssh2
2020-03-05T14:24:54.53
...

Honeypot attack, port: 81, PTR: PTR record not found

suspicious action Thu, 05 Mar 2020 10:35:42 -0300

Mar  5 03:52:17 eddieflores sshd\[6094\]: Invalid user jiangtao from 51.38.71.36
Mar  5 03:52:17 eddieflores sshd\[6094\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.ip-51-38-71.eu
Mar  5 03:52:19 eddieflores sshd\[6094\]: Failed password for invalid user jiangtao from 51.38.71.36 port 35616 ssh2
Mar  5 04:00:52 eddieflores sshd\[6831\]: Invalid user guest from 51.38.71.36
Mar  5 04:00:52 eddieflores sshd\[6831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.ip-51-38-71.eu

1433/tcp 445/tcp...
[2020-01-06/03-05]14pkt,2pt.(tcp)

attempted connection to port 88

Взломали аккаунт Steam сайт cwskins.fun

(sshd) Failed SSH login from 191.34.162.186 (BR/Brazil/191.34.162.186.dynamic.adsl.gvt.net.br): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar  5 11:43:06 ubnt-55d23 sshd[3724]: Invalid user demo from 191.34.162.186 port 43839
Mar  5 11:43:08 ubnt-55d23 sshd[3724]: Failed password for invalid user demo from 191.34.162.186 port 43839 ssh2

From: Walgreens Rewards 
Repetitive Walgreens reward spam - likely fraud – primarily Ukraine ISP; targeted Google phishing redirect; repetitive blacklisted phishing redirect spam links.

No entity name; BBB results for "8 The Green, Dover, DE 19901":
… The websites collect personal information and then transfer it to lenders and other service providers and marketing companies. BBB suggests caution in dealing with these websites. …

Unsolicited bulk spam - (EHLO betrothment.clausloan.eu) (138.97.159.217) – repetitive UBE from IP range 138.97.156.*

Spam link clausloan.eu = 138.97.159.10 My Tech BZ – blacklisted – phishing redirect:
-	www.google.com – effective URL; phishing redirect
-	lukkins.com = 139.99.70.208 Ovh Sas
-	link.agnesta.com = 62.113.207.188 23Media GmbH (previous domain link.orcelsor.com)
-	kq6.securessl.company = 104.223.205.137, 104.223.205.138 Global Frag Networks

Fail2Ban Ban Triggered

445/tcp 1433/tcp...
[2020-01-05/03-05]12pkt,2pt.(tcp)

Mar  5 14:28:57 ns381471 sshd[13587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.202.32.70
Mar  5 14:28:59 ns381471 sshd[13587]: Failed password for invalid user node from 122.202.32.70 port 42654 ssh2

Telnet/23 MH Probe, Scan, BF, Hack -

Honeypot attack, port: 445, PTR: dsl.49.149.98.73.pldt.net.