SIP auth scanning - multiple failed SIP authentication

SIP connect

\[2019-07-05 15:31:56\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:55322' - Wrong password
\[2019-07-05 15:31:56\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-05T15:31:56.837-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="874",SessionID="0x7f02f8335788",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153.170/55322",Challenge="7184d9c9",ReceivedChallenge="7184d9c9",ReceivedHash="5de5387b5edcc5b45b0a0e977d816162"
\[2019-07-05 15:32:11\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:57584' - Wrong password
\[2019-07-05 15:32:11\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-05T15:32:11.435-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="874",SessionID="0x7f02f876b078",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83

\[2019-07-04 19:58:38\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:57815' - Wrong password
\[2019-07-04 19:58:38\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-04T19:58:38.079-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="647",SessionID="0x7f02f8352a28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153.170/57815",Challenge="0ca3f626",ReceivedChallenge="0ca3f626",ReceivedHash="2ba13f68e9256e1707c6b448b23de62f"
\[2019-07-04 19:58:50\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:59882' - Wrong password
\[2019-07-04 19:58:50\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-04T19:58:50.637-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="647",SessionID="0x7f02f8740ce8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83

\[2019-07-04 10:17:48\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:60994' - Wrong password
\[2019-07-04 10:17:48\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-04T10:17:48.075-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="531",SessionID="0x7f02f8740ce8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153.170/60994",Challenge="67f9f0ca",ReceivedChallenge="67f9f0ca",ReceivedHash="4f1490081bf5bdb1cac60f8de8c53852"
\[2019-07-04 10:17:59\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:62932' - Wrong password
\[2019-07-04 10:17:59\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-04T10:17:59.711-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="531",SessionID="0x7f02f8352a28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83

\[2019-07-03 14:28:34\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:54231' - Wrong password
\[2019-07-03 14:28:34\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-03T14:28:34.632-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="284",SessionID="0x7f02f8352a28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153.170/54231",Challenge="3a30152b",ReceivedChallenge="3a30152b",ReceivedHash="e2f2bd67b52739eecd5dcabe98d36e2e"
\[2019-07-03 14:28:46\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:56266' - Wrong password
\[2019-07-03 14:28:46\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-03T14:28:46.722-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="284",SessionID="0x7f02f81ae088",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83

\[2019-07-03 05:08:52\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:61629' - Wrong password
\[2019-07-03 05:08:52\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-03T05:08:52.775-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="168",SessionID="0x7f02f81ae088",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153.170/61629",Challenge="6ca1b49d",ReceivedChallenge="6ca1b49d",ReceivedHash="f98faa62b05a28222cfe135dac47da4d"
\[2019-07-03 05:09:04\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:63827' - Wrong password
\[2019-07-03 05:09:04\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-03T05:09:04.866-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="168",SessionID="0x7f02f80dcfe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83

\[2019-07-02 20:40:29\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:62391' - Wrong password
\[2019-07-02 20:40:29\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-02T20:40:29.503-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="60",SessionID="0x7f02f80d26c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153.170/62391",Challenge="2d68f24d",ReceivedChallenge="2d68f24d",ReceivedHash="6af6c3d1534c810e1af80cb7f67e9b6c"
\[2019-07-02 20:40:41\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '212.83.153.170:64606' - Wrong password
\[2019-07-02 20:40:41\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-02T20:40:41.609-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="60",SessionID="0x7f02f81ae088",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.153

VoIP Brute Force - 212.83.153.170 - Auto Report
...

VoIP Brute Force - 212.83.153.170 - Auto Report
...

SSH bruteforce

2019-10-30 10:24:32,302 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 10:47:18,950 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 11:04:40,327 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 11:22:46,172 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 11:40:00,574 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 10:24:32,302 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 10:47:18,950 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 11:04:40,327 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 11:22:46,172 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 11:40:00,574 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.197.176.130
2019-10-30 10:24:32,302 fail2ban.actions        \[1897\]: NOTICE  \[ssh\] Ban 138.19

Oct 31 14:52:46 DAAP sshd[14944]: Invalid user smmsp from 80.255.130.197 port 44902
Oct 31 14:52:46 DAAP sshd[14944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.255.130.197
Oct 31 14:52:46 DAAP sshd[14944]: Invalid user smmsp from 80.255.130.197 port 44902
Oct 31 14:52:48 DAAP sshd[14944]: Failed password for invalid user smmsp from 80.255.130.197 port 44902 ssh2
Oct 31 14:57:19 DAAP sshd[14969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.255.130.197  user=root
Oct 31 14:57:21 DAAP sshd[14969]: Failed password for root from 80.255.130.197 port 35790 ssh2
...

2019-10-31T20:11:34.708968shield sshd\[18468\]: Invalid user msilva from 103.75.103.211 port 45354
2019-10-31T20:11:34.716016shield sshd\[18468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.75.103.211
2019-10-31T20:11:36.970254shield sshd\[18468\]: Failed password for invalid user msilva from 103.75.103.211 port 45354 ssh2
2019-10-31T20:16:00.986536shield sshd\[19642\]: Invalid user craft from 103.75.103.211 port 54910
2019-10-31T20:16:00.992657shield sshd\[19642\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.75.103.211

Oct 31 06:15:56 eddieflores sshd\[17834\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.224.215  user=root
Oct 31 06:15:59 eddieflores sshd\[17834\]: Failed password for root from 128.199.224.215 port 35714 ssh2
Oct 31 06:20:02 eddieflores sshd\[18162\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.224.215  user=root
Oct 31 06:20:04 eddieflores sshd\[18162\]: Failed password for root from 128.199.224.215 port 44474 ssh2
Oct 31 06:24:11 eddieflores sshd\[19037\]: Invalid user temp from 128.199.224.215

2019-10-30 21:54:17,584 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 22:35:22,076 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 22:50:22,389 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 23:09:35,254 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 23:28:43,343 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 21:54:17,584 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 22:35:22,076 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 22:50:22,389 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 23:09:35,254 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 23:28:43,343 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 21:54:17,584 fail2ban.actions        \[1865\]: NOTICE  \[ssh\] Ban 14.230.4.73
2019-10-30 22:35:22,076 fail2ban.a

/download/file.php?id=177&sid=78413a4c0b7349a3f437813f5ab319dc

Scanning random ports - tries to find possible vulnerable services

Registration form abuse

DATE:2019-10-31 21:15:56, IP:121.154.107.112, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)

Oct 31 22:15:55 taivassalofi sshd[235755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.157.167
Oct 31 22:15:57 taivassalofi sshd[235755]: Failed password for invalid user COM from 51.91.157.167 port 38816 ssh2
...

Unauthorized connection attempt from IP address 117.241.96.70 on Port 445(SMB)

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/109.93.31.242/ 
 
 RS - 1H : (3)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : RS 
 NAME ASN : ASN8400 
 
 IP : 109.93.31.242 
 
 CIDR : 109.92.0.0/15 
 
 PREFIX COUNT : 79 
 
 UNIQUE IP COUNT : 711680 
 
 
 ATTACKS DETECTED ASN8400 :  
  1H - 2 
  3H - 2 
  6H - 2 
 12H - 3 
 24H - 3 
 
 DateTime : 2019-10-31 21:15:56 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

PostgreSQL port 5432

Port scan on 6 port(s): 5634 5924 6002 6317 6393 6454