This should be easy to modify to get what you want. There are some more succinct methods to query deep hashes, cant find the module right now.

while(<DATA>){
        if (/New connection: ([\d\.]+):(\d+)/){
                ($ip,$port) = ($1,$2);
                next;
        }
        chomp;
        if (/login attempt\s+\[(.*)\]\s+(\w+)$/){
                ($user_pass,$status) = ($1,$2);
                $HONEY{$ip}{$port}{$status}{$user_pass} +=1;
                print "DEBUG: Add ip=$ip:$port $status $user_pass\n";
        }
}

for my $ip (keys %HONEY){
        for my $port (keys %{$HONEY{$ip}}){
                for my $user (keys %{$HONEY{$ip}{$port}}){
                        for my $status (keys %{$HONEY{$ip}{$port}}){
                                for my $user_pass (keys %{$HONEY{$ip}{
+$port}{$status}}){
                                        $freq = $HONEY{$ip}{$port}{$st
+atus}{$user_pass};
                                        push(@DATA, "$port,$status,$fr
+eq") ;
                                }
                        }
                }
        }
}

for my $data (sort @DATA){
        print $data . "\n";
}

__DATA__
2016-04-29 15:56:48+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 89.248.167.131:46055 (172.17.0.2:2222) [session: 3b8d22b
+5]
2016-04-29 15:56:49+0000 [SSHService ssh-userauth on HoneyPotTransport
+,28,89.248.167.131] login attempt [root/root] succeeded
2016-04-29 16:11:14+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 52.28.89.99:53059 (172.17.0.2:2222) [session: a6c0fac1]
2016-04-29 16:17:42+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 13.92.114.157:1032 (172.17.0.2:2222) [session: d33e1566]
2016-04-29 19:07:10+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 89.248.167.131:45178 (172.17.0.6:2222) [session: fafec37
+d]
2016-04-29 19:07:10+0000 [SSHService ssh-userauth on HoneyPotTransport
+,0,89.248.167.131] login attempt [root/root] succeeded
2016-04-29 19:42:58+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 89.248.167.131:56925 (172.17.0.6:2222) [session: 539960a
+3]
2016-04-29 19:42:58+0000 [SSHService ssh-userauth on HoneyPotTransport
+,1,89.248.167.131] login attempt [root/root] succeeded
2016-04-29 20:39:03+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 89.248.167.131:54138 (172.17.0.6:2222) [session: b9f550d
+f]
2016-04-29 20:39:03+0000 [SSHService ssh-userauth on HoneyPotTransport
+,2,89.248.167.131] login attempt [root/root] succeeded
2016-04-29 21:13:41+0000 [cowrie.ssh.transport.HoneyPotSSHFactory] New
+ connection: 141.8.83.213:64400 (172.17.0.6:2222) [session: e696835c]
2016-04-29 21:13:59+0000 [SSHService ssh-userauth on HoneyPotTransport
+,3,141.8.83.213] login attempt [user1/test123] failed
2016-04-29 21:14:10+0000 [SSHService ssh-userauth on HoneyPotTransport
+,3,141.8.83.213] login attempt [user1/test1234] failed
2016-04-29 21:14:13+0000 [SSHService ssh-userauth on HoneyPotTransport
+,3,141.8.83.213] login attempt [user1/test123] failed

[download]

In reply to Re: Increment frequency of attempts based on IP and login details combination by FreeBeerReekingMonk
in thread Increment frequency of attempts based on IP and login details combination by firepro20

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.