Honeypot attack, application: ssdp, PTR: PTR record not found

Coordinated SSH brute-force attack from different IPs. pam_unix(sshd:auth):

2020-09-19T21:25:47.545759hostname sshd[30716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
2020-09-19T21:25:47.517033hostname sshd[30716]: Invalid user ts33 from 206.189.178.171 port 36568
2020-09-19T21:25:48.990576hostname sshd[30716]: Failed password for invalid user ts33 from 206.189.178.171 port 36568 ssh2
...

(sshd) Failed SSH login from 206.189.178.171 (US/United States/-): 5 in the last 3600 secs

s2.hscode.pl - SSH Attack

Aug 24 13:51:10 home sshd[7412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171 
Aug 24 13:51:10 home sshd[7412]: Invalid user jessie from 206.189.178.171 port 58898
Aug 24 13:51:12 home sshd[7412]: Failed password for invalid user jessie from 206.189.178.171 port 58898 ssh2
Aug 24 13:53:39 home sshd[8088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
Aug 24 13:53:41 home sshd[8088]: Failed password for root from 206.189.178.171 port 43524 ssh2
...

Jul 26 17:53:48 rancher-0 sshd[591324]: Invalid user tanvir from 206.189.178.171 port 40070
...

Jul 24 16:11:54 vmd36147 sshd[21279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
Jul 24 16:11:55 vmd36147 sshd[21279]: Failed password for invalid user debian from 206.189.178.171 port 54304 ssh2
Jul 24 16:15:44 vmd36147 sshd[29602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
...

Invalid user admin from 206.189.178.171 port 40028

Jun 17 13:17:03 legacy sshd[11191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
Jun 17 13:17:05 legacy sshd[11191]: Failed password for invalid user limpa from 206.189.178.171 port 37958 ssh2
Jun 17 13:20:04 legacy sshd[11274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
...

Jun 16 19:20:37 h2779839 sshd[7030]: Invalid user web from 206.189.178.171 port 58128
Jun 16 19:20:37 h2779839 sshd[7030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
Jun 16 19:20:37 h2779839 sshd[7030]: Invalid user web from 206.189.178.171 port 58128
Jun 16 19:20:39 h2779839 sshd[7030]: Failed password for invalid user web from 206.189.178.171 port 58128 ssh2
Jun 16 19:23:53 h2779839 sshd[7094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
Jun 16 19:23:55 h2779839 sshd[7094]: Failed password for root from 206.189.178.171 port 58336 ssh2
Jun 16 19:27:10 h2779839 sshd[7132]: Invalid user samira from 206.189.178.171 port 58538
Jun 16 19:27:10 h2779839 sshd[7132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171
Jun 16 19:27:10 h2779839 sshd[7132]: Invalid user samira from 206.189.178.171 port 58538
Jun 16
...

$f2bV_matches

Jun  8 07:10:05 PorscheCustomer sshd[7924]: Failed password for root from 206.189.178.171 port 34296 ssh2
Jun  8 07:11:19 PorscheCustomer sshd[8013]: Failed password for root from 206.189.178.171 port 51838 ssh2
...

Jun  6 01:24:06 abendstille sshd\[18693\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
Jun  6 01:24:08 abendstille sshd\[18693\]: Failed password for root from 206.189.178.171 port 47360 ssh2
Jun  6 01:30:25 abendstille sshd\[25734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
Jun  6 01:30:27 abendstille sshd\[25734\]: Failed password for root from 206.189.178.171 port 49594 ssh2
Jun  6 01:33:35 abendstille sshd\[28742\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
...

2020-06-04T20:15:05.958555abusebot-7.cloudsearch.cf sshd[32644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
2020-06-04T20:15:08.213015abusebot-7.cloudsearch.cf sshd[32644]: Failed password for root from 206.189.178.171 port 42414 ssh2
2020-06-04T20:17:48.585536abusebot-7.cloudsearch.cf sshd[325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
2020-06-04T20:17:50.549261abusebot-7.cloudsearch.cf sshd[325]: Failed password for root from 206.189.178.171 port 37168 ssh2
2020-06-04T20:20:31.725708abusebot-7.cloudsearch.cf sshd[523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.178.171  user=root
2020-06-04T20:20:33.732409abusebot-7.cloudsearch.cf sshd[523]: Failed password for root from 206.189.178.171 port 60152 ssh2
2020-06-04T20:23:16.040342abusebot-7.cloudsearch.cf sshd[682]: pam_unix(sshd:auth): aut
...

May 16 03:45:13 xeon sshd[20853]: Failed password for invalid user user from 206.189.178.171 port 35742 ssh2

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/79.116.130.221/ 
 
 RO - 1H : (30)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : RO 
 NAME ASN : ASN8708 
 
 IP : 79.116.130.221 
 
 CIDR : 79.112.0.0/13 
 
 PREFIX COUNT : 236 
 
 UNIQUE IP COUNT : 2129408 
 
 
 ATTACKS DETECTED ASN8708 :  
  1H - 1 
  3H - 3 
  6H - 6 
 12H - 10 
 24H - 15 
 
 DateTime : 2019-10-21 05:55:06 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Unauthorised access (Oct 21) SRC=121.69.53.246 LEN=44 TOS=0x10 PREC=0x40 TTL=233 ID=17895 TCP DPT=1433 WINDOW=1024 SYN

Oct 20 18:28:33 php1 sshd\[6620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.182.47.132  user=root
Oct 20 18:28:36 php1 sshd\[6620\]: Failed password for root from 180.182.47.132 port 45967 ssh2
Oct 20 18:32:49 php1 sshd\[7151\]: Invalid user guest3 from 180.182.47.132
Oct 20 18:32:49 php1 sshd\[7151\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.182.47.132
Oct 20 18:32:51 php1 sshd\[7151\]: Failed password for invalid user guest3 from 180.182.47.132 port 37811 ssh2

Oct 21 06:47:07 dedicated sshd[23646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.215  user=root
Oct 21 06:47:09 dedicated sshd[23646]: Failed password for root from 222.186.173.215 port 50796 ssh2

Oct 21 06:39:54 meumeu sshd[5164]: Failed password for root from 222.186.175.183 port 58354 ssh2
Oct 21 06:40:08 meumeu sshd[5164]: Failed password for root from 222.186.175.183 port 58354 ssh2
Oct 21 06:40:13 meumeu sshd[5164]: Failed password for root from 222.186.175.183 port 58354 ssh2
Oct 21 06:40:14 meumeu sshd[5164]: error: maximum authentication attempts exceeded for root from 222.186.175.183 port 58354 ssh2 [preauth]
...

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/46.1.154.108/ 
 
 TR - 1H : (55)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TR 
 NAME ASN : ASN34296 
 
 IP : 46.1.154.108 
 
 CIDR : 46.1.154.0/24 
 
 PREFIX COUNT : 281 
 
 UNIQUE IP COUNT : 111360 
 
 
 ATTACKS DETECTED ASN34296 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 2 
 24H - 2 
 
 DateTime : 2019-10-21 05:55:28 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Oct 21 06:44:23 dedicated sshd[23313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.130.69  user=root
Oct 21 06:44:25 dedicated sshd[23313]: Failed password for root from 27.254.130.69 port 37232 ssh2

Oct 21 05:55:39 dedicated sshd[16672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.46.170  user=root
Oct 21 05:55:41 dedicated sshd[16672]: Failed password for root from 129.204.46.170 port 58952 ssh2

10/20/2019-23:55:58.948580 92.118.37.86 Protocol: 6 ET SCAN NMAP -sS window 1024

Attempts to probe for or exploit a Drupal site on url: /wp-login.php. Reported by the module https://www.drupal.org/project/abuseipdb.

Oct 21 06:46:19 site3 sshd\[143047\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.234.203  user=root
Oct 21 06:46:21 site3 sshd\[143047\]: Failed password for root from 200.122.234.203 port 54272 ssh2
Oct 21 06:50:46 site3 sshd\[143124\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.234.203  user=root
Oct 21 06:50:49 site3 sshd\[143124\]: Failed password for root from 200.122.234.203 port 36634 ssh2
Oct 21 06:55:14 site3 sshd\[143214\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.234.203  user=root
...

Apr 13 18:46:40 vtv3 sshd\[19350\]: Invalid user akasaka from 51.83.41.120 port 39666
Apr 13 18:46:40 vtv3 sshd\[19350\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.41.120
Apr 13 18:46:42 vtv3 sshd\[19350\]: Failed password for invalid user akasaka from 51.83.41.120 port 39666 ssh2
Apr 13 18:51:44 vtv3 sshd\[21758\]: Invalid user thanawat from 51.83.41.120 port 33894
Apr 13 18:51:44 vtv3 sshd\[21758\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.41.120
Apr 18 01:02:36 vtv3 sshd\[24118\]: Invalid user db2inst1 from 51.83.41.120 port 48512
Apr 18 01:02:36 vtv3 sshd\[24118\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.41.120
Apr 18 01:02:38 vtv3 sshd\[24118\]: Failed password for invalid user db2inst1 from 51.83.41.120 port 48512 ssh2
Apr 18 01:07:42 vtv3 sshd\[26543\]: Invalid user yckim from 51.83.41.120 port 42742
Apr 18 01:07:42 vtv3 sshd\[26543\]: p

MultiHost/MultiPort Probe, Scan, Hack -

\[2019-10-21 00:41:44\] NOTICE\[2038\] chan_sip.c: Registration from '\' failed for '45.143.220.13:54594' - Wrong password
\[2019-10-21 00:41:44\] SECURITY\[2046\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-21T00:41:44.200-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1000",SessionID="0x7f6130477218",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.13/54594",Challenge="3a679145",ReceivedChallenge="3a679145",ReceivedHash="d99423412a2afa5e075b100ecf79bf75"
\[2019-10-21 00:42:50\] NOTICE\[2038\] chan_sip.c: Registration from '\' failed for '45.143.220.13:49290' - Wrong password
\[2019-10-21 00:42:50\] SECURITY\[2046\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-21T00:42:50.019-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1000",SessionID="0x7f6130477218",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.22

DATE:2019-10-21 05:55:44, IP:36.152.65.193, PORT:telnet - Telnet brute force auth on a honeypot server (epe-dc)