(sshd) Failed SSH login from 51.144.73.94 (NL/Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 24 21:51:00 optimus sshd[421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.144.73.94  user=root
Sep 24 21:51:00 optimus sshd[422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.144.73.94  user=root
Sep 24 21:51:00 optimus sshd[424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.144.73.94  user=root
Sep 24 21:51:00 optimus sshd[425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.144.73.94  user=root
Sep 24 21:51:00 optimus sshd[420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.144.73.94  user=root

51.144.73.114 - - [09/Aug/2020:22:48:48 +0200] "GET /wp-login.php HTTP/1.1" 200 6060 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [09/Aug/2020:22:48:49 +0200] "POST /wp-login.php HTTP/1.1" 200 6311 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [09/Aug/2020:22:48:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

51.144.73.114 - - [07/Aug/2020:14:08:01 +0200] "GET /wp-login.php HTTP/1.1" 200 6310 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [07/Aug/2020:14:08:02 +0200] "POST /wp-login.php HTTP/1.1" 200 6561 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [07/Aug/2020:14:08:02 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

51.144.73.114 - - [02/Aug/2020:04:53:34 +0100] "POST /wp-login.php HTTP/1.1" 200 2261 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [02/Aug/2020:04:53:35 +0100] "POST /wp-login.php HTTP/1.1" 200 2258 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [02/Aug/2020:04:53:35 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

51.144.73.114 - - [30/Jul/2020:10:09:55 +0200] "GET /wp-login.php HTTP/1.1" 200 5738 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [30/Jul/2020:10:09:56 +0200] "POST /wp-login.php HTTP/1.1" 200 5989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [30/Jul/2020:10:09:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Hacking activity

diesunddas.net 51.144.73.114 [04/Jul/2020:04:22:08 +0200] "POST /wp-login.php HTTP/1.1" 200 8449 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
diesunddas.net 51.144.73.114 [04/Jul/2020:04:22:08 +0200] "POST /wp-login.php HTTP/1.1" 200 8449 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

51.144.73.114 has been banned for [WebApp Attack]
...

51.144.73.114 - - \[25/Jun/2020:20:14:36 +0200\] "POST /wp-login.php HTTP/1.1" 200 9954 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - \[25/Jun/2020:20:14:37 +0200\] "POST /wp-login.php HTTP/1.1" 200 9823 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
...

51.144.73.114 - - [23/Jun/2020:09:10:18 +0100] "POST /wp-login.php HTTP/1.1" 200 1996 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [23/Jun/2020:09:10:20 +0100] "POST /wp-login.php HTTP/1.1" 200 1924 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [23/Jun/2020:09:10:22 +0100] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

51.144.73.114 - - [22/Jun/2020:10:39:17 +0100] "POST /wp-login.php HTTP/1.1" 200 1927 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [22/Jun/2020:10:39:18 +0100] "POST /wp-login.php HTTP/1.1" 200 1885 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [22/Jun/2020:10:39:18 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

51.144.73.114 - - [19/Jun/2020:01:02:42 +0200] "GET /wp-login.php HTTP/1.1" 200 5738 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [19/Jun/2020:01:02:43 +0200] "POST /wp-login.php HTTP/1.1" 200 5989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [19/Jun/2020:01:02:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Automatic report - XMLRPC Attack

51.144.73.114 - - [04/Jun/2020:14:09:28 +0200] "GET /wp-login.php HTTP/1.1" 200 1689 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [04/Jun/2020:14:09:28 +0200] "POST /wp-login.php HTTP/1.1" 200 1811 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [04/Jun/2020:14:09:28 +0200] "GET /wp-login.php HTTP/1.1" 200 1689 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [04/Jun/2020:14:09:28 +0200] "POST /wp-login.php HTTP/1.1" 200 1799 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [04/Jun/2020:14:09:28 +0200] "GET /wp-login.php HTTP/1.1" 200 1689 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [04/Jun/2020:14:09:28 +0200] "POST /wp-login.php HTTP/1.1" 200 1798 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Fir
...

51.144.73.114 - - [03/Jun/2020:18:04:05 +0200] "POST /xmlrpc.php HTTP/1.1" 403 15310 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.144.73.114 - - [03/Jun/2020:18:07:56 +0200] "POST /xmlrpc.php HTTP/1.1" 403 611 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

xmlrpc attack

Sep 26 15:25:04 web1 sshd\[28062\]: Invalid user amavis from 175.207.219.185
Sep 26 15:25:04 web1 sshd\[28062\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.207.219.185
Sep 26 15:25:06 web1 sshd\[28062\]: Failed password for invalid user amavis from 175.207.219.185 port 13646 ssh2
Sep 26 15:30:04 web1 sshd\[28523\]: Invalid user temp from 175.207.219.185
Sep 26 15:30:04 web1 sshd\[28523\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.207.219.185

Sep 27 04:08:34 sshgateway sshd\[20094\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.183  user=root
Sep 27 04:08:36 sshgateway sshd\[20094\]: Failed password for root from 222.186.173.183 port 37486 ssh2
Sep 27 04:08:48 sshgateway sshd\[20094\]: Failed password for root from 222.186.173.183 port 37486 ssh2

Sep 27 03:40:04 hosting sshd[12041]: Invalid user ec2-user from 180.168.70.190 port 45962
...

Sep 26 18:09:54 sachi sshd\[21791\]: Invalid user walter from 148.70.59.114
Sep 26 18:09:54 sachi sshd\[21791\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.59.114
Sep 26 18:09:56 sachi sshd\[21791\]: Failed password for invalid user walter from 148.70.59.114 port 21574 ssh2
Sep 26 18:14:53 sachi sshd\[22203\]: Invalid user sonya from 148.70.59.114
Sep 26 18:14:53 sachi sshd\[22203\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.59.114

Sep 26 15:24:19 eddieflores sshd\[19426\]: Invalid user elyzabeth from 76.74.170.93
Sep 26 15:24:19 eddieflores sshd\[19426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.74.170.93
Sep 26 15:24:21 eddieflores sshd\[19426\]: Failed password for invalid user elyzabeth from 76.74.170.93 port 41754 ssh2
Sep 26 15:28:54 eddieflores sshd\[19870\]: Invalid user dwdev from 76.74.170.93
Sep 26 15:28:54 eddieflores sshd\[19870\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.74.170.93

Sep 26 15:17:49 lcprod sshd\[12304\]: Invalid user shang from 122.161.192.206
Sep 26 15:17:49 lcprod sshd\[12304\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.161.192.206
Sep 26 15:17:51 lcprod sshd\[12304\]: Failed password for invalid user shang from 122.161.192.206 port 47768 ssh2
Sep 26 15:23:01 lcprod sshd\[12790\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.161.192.206  user=mail
Sep 26 15:23:03 lcprod sshd\[12790\]: Failed password for mail from 122.161.192.206 port 44952 ssh2

Sep 26 23:02:26 localhost sshd\[24745\]: Invalid user kids from 200.34.227.145 port 55282
Sep 26 23:02:26 localhost sshd\[24745\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.34.227.145
Sep 26 23:02:28 localhost sshd\[24745\]: Failed password for invalid user kids from 200.34.227.145 port 55282 ssh2
...

\[2019-09-26 23:55:57\] NOTICE\[1948\] chan_sip.c: Registration from '"220" \' failed for '94.177.243.130:5157' - Wrong password
\[2019-09-26 23:55:57\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-26T23:55:57.140-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="220",SessionID="0x7f1e1c0a98e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/94.177.243.130/5157",Challenge="3603fbd8",ReceivedChallenge="3603fbd8",ReceivedHash="9e07b826d55a04133081ffa925f0491a"
\[2019-09-26 23:56:20\] NOTICE\[1948\] chan_sip.c: Registration from '"651" \' failed for '94.177.243.130:5184' - Wrong password
\[2019-09-26 23:56:20\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-26T23:56:20.061-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="651",SessionID="0x7f1e1c2bed58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/9

Sep 26 15:20:36 hpm sshd\[477\]: Invalid user mailtest from 207.154.206.212
Sep 26 15:20:36 hpm sshd\[477\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.206.212
Sep 26 15:20:38 hpm sshd\[477\]: Failed password for invalid user mailtest from 207.154.206.212 port 53860 ssh2
Sep 26 15:24:51 hpm sshd\[900\]: Invalid user ubnt from 207.154.206.212
Sep 26 15:24:51 hpm sshd\[900\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.206.212

Automatic report - Port Scan Attack

Sep 27 06:56:22 taivassalofi sshd[191636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.213.91
Sep 27 06:56:24 taivassalofi sshd[191636]: Failed password for invalid user osadrc from 178.128.213.91 port 57158 ssh2
...

Automatic report - Port Scan Attack

2019-09-27T02:05:31.810614centos sshd\[10778\]: Invalid user User from 41.65.64.36 port 32834
2019-09-27T02:05:31.815833centos sshd\[10778\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.65.64.36
2019-09-27T02:05:33.906370centos sshd\[10778\]: Failed password for invalid user User from 41.65.64.36 port 32834 ssh2

[ThuSep2623:17:28.1750942019][:error][pid3029:tid47123152365312][client35.202.213.9:56856][client35.202.213.9]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"python-requests/"atREQUEST_HEADERS:User-Agent.[file"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf"][line"211"][id"332039"][rev"4"][msg"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/."][severity"CRITICAL"][hostname"thaiboxingbellinzona.ch"][uri"/robots.txt"][unique_id"XY0q6Kxn-g-fAg881NDyyQAAAMA"][ThuSep2623:17:28.3106472019][:error][pid3029:tid47123152365312][client35.202.213.9:56856][client35.202.213.9]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"python-requests/"atREQUEST_HEADERS:User-Agent.[file"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf"][line"211"][id"332039"][rev"4"][msg"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/."][severity"CRITICAL"][hostname

Sep2623:12:33server2sshd[4955]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:14:41server2sshd[5473]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:14:42server2sshd[5477]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:14:43server2sshd[5479]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:14:44server2sshd[5483]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:14:44server2sshd[5484]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:17:16server2sshd[6413]:refusedconnectfrom185.156.177.197\(185.156.177.197\)Sep2623:17:19server2sshd[6417]:refusedconnectfrom185.156.177.197\(185.156.177.197\)