Honeypot attack, port: 445, PTR: PTR record not found

Dec 18 07:41:28 markkoudstaal sshd[22708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.17.223
Dec 18 07:41:29 markkoudstaal sshd[22708]: Failed password for invalid user tresa from 202.83.17.223 port 47024 ssh2
Dec 18 07:47:31 markkoudstaal sshd[23357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.17.223

$f2bV_matches

Dec 18 10:26:14 pkdns2 sshd\[60771\]: Failed password for root from 49.88.112.68 port 30502 ssh2Dec 18 10:26:15 pkdns2 sshd\[60771\]: Failed password for root from 49.88.112.68 port 30502 ssh2Dec 18 10:26:18 pkdns2 sshd\[60771\]: Failed password for root from 49.88.112.68 port 30502 ssh2Dec 18 10:27:42 pkdns2 sshd\[60851\]: Failed password for root from 49.88.112.68 port 59006 ssh2Dec 18 10:30:01 pkdns2 sshd\[60961\]: Failed password for root from 49.88.112.68 port 20315 ssh2Dec 18 10:30:03 pkdns2 sshd\[60961\]: Failed password for root from 49.88.112.68 port 20315 ssh2
...

\[2019-12-18 03:29:32\] NOTICE\[2839\] chan_sip.c: Registration from '562 \' failed for '77.247.109.63:5060' - Wrong password
\[2019-12-18 03:29:32\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-18T03:29:32.947-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="562",SessionID="0x7f0fb40c0358",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.109.63/5060",Challenge="11116feb",ReceivedChallenge="11116feb",ReceivedHash="5ae079675e6c8c84ab569f93da0818c6"
\[2019-12-18 03:29:34\] NOTICE\[2839\] chan_sip.c: Registration from '563 \' failed for '77.247.109.63:5060' - Wrong password
\[2019-12-18 03:29:34\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-18T03:29:34.418-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="563",SessionID="0x7f0fb462f398",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.1

Dec 18 01:44:11 linuxvps sshd\[58186\]: Invalid user tina from 106.75.34.41
Dec 18 01:44:11 linuxvps sshd\[58186\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.34.41
Dec 18 01:44:13 linuxvps sshd\[58186\]: Failed password for invalid user tina from 106.75.34.41 port 46590 ssh2
Dec 18 01:51:19 linuxvps sshd\[62534\]: Invalid user jaramillo from 106.75.34.41
Dec 18 01:51:19 linuxvps sshd\[62534\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.34.41

Dec 18 09:07:17 dedicated sshd[21757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.9  user=root
Dec 18 09:07:19 dedicated sshd[21757]: Failed password for root from 222.186.180.9 port 10980 ssh2

Host Scan

Dec 18 08:59:56 OPSO sshd\[7550\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.233.104  user=root
Dec 18 08:59:58 OPSO sshd\[7550\]: Failed password for root from 27.128.233.104 port 34902 ssh2
Dec 18 09:07:49 OPSO sshd\[9199\]: Invalid user chaplin from 27.128.233.104 port 34670
Dec 18 09:07:49 OPSO sshd\[9199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.233.104
Dec 18 09:07:51 OPSO sshd\[9199\]: Failed password for invalid user chaplin from 27.128.233.104 port 34670 ssh2

Invalid user bacciaglia from 46.105.244.1 port 49361

Lines containing failures of 27.78.103.132
Dec 16 07:19:05 shared02 sshd[20588]: Invalid user backuppc from 27.78.103.132 port 51763
Dec 16 07:19:05 shared02 sshd[20588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.78.103.132
Dec 16 07:19:07 shared02 sshd[20588]: Failed password for invalid user backuppc from 27.78.103.132 port 51763 ssh2
Dec 16 07:19:08 shared02 sshd[20588]: Connection closed by invalid user backuppc 27.78.103.132 port 51763 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=27.78.103.132

Lines containing failures of 210.183.61.148
Dec 18 05:20:09 zabbix sshd[4121]: Invalid user dpp from 210.183.61.148 port 33062
Dec 18 05:20:09 zabbix sshd[4121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.183.61.148
Dec 18 05:20:11 zabbix sshd[4121]: Failed password for invalid user dpp from 210.183.61.148 port 33062 ssh2
Dec 18 05:20:11 zabbix sshd[4121]: Received disconnect from 210.183.61.148 port 33062:11: Bye Bye [preauth]
Dec 18 05:20:11 zabbix sshd[4121]: Disconnected from invalid user dpp 210.183.61.148 port 33062 [preauth]
Dec 18 05:31:05 zabbix sshd[5194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.183.61.148  user=r.r
Dec 18 05:31:07 zabbix sshd[5194]: Failed password for r.r from 210.183.61.148 port 47952 ssh2
Dec 18 05:31:08 zabbix sshd[5194]: Received disconnect from 210.183.61.148 port 47952:11: Bye Bye [preauth]
Dec 18 05:31:08 zabbix sshd[5194]: Disconnected........
------------------------------

Dec 18 09:07:56 vtv3 sshd[20245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.77.243 
Dec 18 09:07:58 vtv3 sshd[20245]: Failed password for invalid user benida from 106.13.77.243 port 45624 ssh2
Dec 18 09:15:30 vtv3 sshd[23925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.77.243 
Dec 18 09:40:52 vtv3 sshd[3696]: Failed password for root from 106.13.77.243 port 45978 ssh2
Dec 18 09:47:19 vtv3 sshd[6608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.77.243 
Dec 18 09:47:21 vtv3 sshd[6608]: Failed password for invalid user pcap from 106.13.77.243 port 39468 ssh2
Dec 18 10:00:24 vtv3 sshd[12731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.77.243 
Dec 18 10:00:26 vtv3 sshd[12731]: Failed password for invalid user helpdesk from 106.13.77.243 port 54658 ssh2
Dec 18 10:07:12 vtv3 sshd[15867]: pam_unix(sshd:auth): aut

$f2bV_matches

Scanning random ports - tries to find possible vulnerable services