xmlrpc attack

Jul 30 21:35:46 server sshd\[114281\]: Invalid user aubrey from 162.241.38.136
Jul 30 21:35:46 server sshd\[114281\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.38.136
Jul 30 21:35:48 server sshd\[114281\]: Failed password for invalid user aubrey from 162.241.38.136 port 34870 ssh2
...

Oct  9 09:06:28 rotator sshd\[10979\]: Address 162.247.72.199 maps to jaffer.tor-exit.calyxinstitute.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct  9 09:06:29 rotator sshd\[10979\]: Failed password for root from 162.247.72.199 port 59250 ssh2Oct  9 09:06:32 rotator sshd\[10979\]: Failed password for root from 162.247.72.199 port 59250 ssh2Oct  9 09:06:34 rotator sshd\[10979\]: Failed password for root from 162.247.72.199 port 59250 ssh2Oct  9 09:06:37 rotator sshd\[10979\]: Failed password for root from 162.247.72.199 port 59250 ssh2Oct  9 09:06:40 rotator sshd\[10979\]: Failed password for root from 162.247.72.199 port 59250 ssh2
...

Jul  5 15:56:07 server sshd\[199796\]: Invalid user wendel from 162.243.136.230
Jul  5 15:56:07 server sshd\[199796\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Jul  5 15:56:09 server sshd\[199796\]: Failed password for invalid user wendel from 162.243.136.230 port 56066 ssh2
...

Jul  7 03:34:51 server sshd\[31990\]: Invalid user guest2 from 162.243.94.34
Jul  7 03:34:51 server sshd\[31990\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.94.34
Jul  7 03:34:53 server sshd\[31990\]: Failed password for invalid user guest2 from 162.243.94.34 port 40977 ssh2
...

Brute force attempt

Oct  9 04:09:26 www_kotimaassa_fi sshd[12211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.251.1
Oct  9 04:09:28 www_kotimaassa_fi sshd[12211]: Failed password for invalid user 123Retail from 142.93.251.1 port 55886 ssh2
...

May 15 00:44:11 server sshd\[232000\]: Invalid user camera from 163.125.153.48
May 15 00:44:11 server sshd\[232000\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.125.153.48
May 15 00:44:13 server sshd\[232000\]: Failed password for invalid user camera from 163.125.153.48 port 40918 ssh2
...

2019-10-09T07:41:05.177698abusebot.cloudsearch.cf sshd\[14015\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.244.70.35  user=root

$f2bV_matches

(sshd) Failed SSH login from 191.235.91.156 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  9 05:31:32 server2 sshd[13985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.235.91.156  user=root
Oct  9 05:31:34 server2 sshd[13985]: Failed password for root from 191.235.91.156 port 34450 ssh2
Oct  9 05:44:33 server2 sshd[15472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.235.91.156  user=root
Oct  9 05:44:35 server2 sshd[15472]: Failed password for root from 191.235.91.156 port 42472 ssh2
Oct  9 05:54:11 server2 sshd[16556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.235.91.156  user=root

2019-10-09 00:57:48,248 fail2ban.actions        [1838]: NOTICE  [sshd] Ban 162.243.253.67

Oct  8 22:50:19 mailman postfix/smtpd[15990]: NOQUEUE: reject: RCPT from unknown[180.128.1.5]: 554 5.7.1 Service unavailable; Client host [180.128.1.5] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/180.128.1.5 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=<[180.183.136.89]>
Oct  8 22:54:25 mailman postfix/smtpd[16024]: NOQUEUE: reject: RCPT from unknown[180.128.1.5]: 554 5.7.1 Service unavailable; Client host [180.128.1.5] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/180.128.1.5 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=<[180.183.136.89]>

Oct908:56:20server4pure-ftpd:\(\?@60.168.93.125\)[WARNING]Authenticationfailedforuser[www]Oct908:27:56server4pure-ftpd:\(\?@117.65.145.59\)[WARNING]Authenticationfailedforuser[www]Oct909:04:43server4pure-ftpd:\(\?@117.65.145.59\)[WARNING]Authenticationfailedforuser[www]Oct908:56:27server4pure-ftpd:\(\?@60.168.93.125\)[WARNING]Authenticationfailedforuser[www]Oct909:14:28server4pure-ftpd:\(\?@121.26.194.238\)[WARNING]Authenticationfailedforuser[www]Oct909:14:37server4pure-ftpd:\(\?@121.26.194.238\)[WARNING]Authenticationfailedforuser[www]Oct909:04:35server4pure-ftpd:\(\?@117.65.145.59\)[WARNING]Authenticationfailedforuser[www]Oct909:04:24server4pure-ftpd:\(\?@117.65.145.59\)[WARNING]Authenticationfailedforuser[www]Oct909:04:50server4pure-ftpd:\(\?@117.65.145.59\)[WARNING]Authenticationfailedforuser[www]Oct908:28:02server4pure-ftpd:\(\?@117.65.145.59\)[WARNING]Authenticationfailedforuser[www]IPAddressesBlocked:

Oct  9 09:03:26 microserver sshd[44932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.110.50  user=root
Oct  9 09:03:28 microserver sshd[44932]: Failed password for root from 91.121.110.50 port 48983 ssh2
Oct  9 09:07:25 microserver sshd[45529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.110.50  user=root
Oct  9 09:07:27 microserver sshd[45529]: Failed password for root from 91.121.110.50 port 40630 ssh2
Oct  9 09:11:33 microserver sshd[46132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.110.50  user=root
Oct  9 09:23:18 microserver sshd[47504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.110.50  user=root
Oct  9 09:23:21 microserver sshd[47504]: Failed password for root from 91.121.110.50 port 35444 ssh2
Oct  9 09:27:09 microserver sshd[48077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid

[portscan] Port scan