# incident

plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 02:42:34 host2 sshd[2418833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-02 02:43:17 dovecot_plain authenticator failed for (cannons) [65.20.164.137]:59992: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.155
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.155: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-11-02 02:55:44 dovecot_plain authenticator failed for (pyrrings) [87.121.76.190]:51469: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.155
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.155: 539 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.42
country_id: 617790
description:
2025-11-02 03:02:21 dovecot_login authenticator failed for (ADMIN) [178.175.129.42]:16590: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-02 03:04:13 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (regue) [98.40.101.10]:60888: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-02 03:04:41 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:34072: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-02 03:04:53 dovecot_plain authenticator failed for (staxinic) [64.53.7.231]:47546: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-02 03:07:08 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:58214: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-02 03:07:23 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:52386: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-02 03:07:48 dovecot_plain authenticator failed for (cianicer) [65.20.251.71]:40110: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 03:09:34 host2 sshd[2449635]: Disconnected from invalid user admin 2.57.121.112 port 40681 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-02 03:11:12 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (regallum) [98.40.101.10]:50204: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-02 03:13:37 dovecot_plain authenticator failed for (epracame) [94.204.236.202]:57231: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Nov  2 03:15:12 host2 sshd[2456483]: Disconnected from invalid user mcserver 186.31.95.163 port 39932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.84.203.52
country_id: 2510769
description:
Nov  2 03:18:34 host2 sshd[2459747]: Disconnected from invalid user yang 188.84.203.52 port 44338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-02 03:18:43 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:52505: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-02 03:18:53 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:42818: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Nov  2 03:19:25 host2 sshd[2460614]: Disconnected from invalid user next 154.221.22.203 port 51480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.31.95.163
country_id: 3686110
description:
Nov  2 03:20:32 host2 sshd[2461803]: Disconnected from invalid user coen 186.31.95.163 port 59984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.84.203.52
country_id: 2510769
description:
Nov  2 03:21:20 host2 sshd[2462508]: Disconnected from invalid user oot 188.84.203.52 port 38732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Nov  2 03:24:07 host2 sshd[2465254]: Disconnected from invalid user deployer 186.31.95.163 port 54666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Nov  2 03:23:24 host2 sshd[2464425]: Disconnected from invalid user default 154.221.22.203 port 35226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.198
country_id: 2960313
description:
2025-11-02 03:24:53 dovecot_login authenticator failed for (ADMIN) [37.46.113.198]:3600: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.84.203.52
country_id: 2510769
description:
Nov  2 03:25:06 host2 sshd[2466294]: Disconnected from invalid user testtest 188.84.203.52 port 34186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.184.55.148
country_id: 1269750
description:
Nov  2 03:26:26 host2 sshd[2467550]: Disconnected from invalid user chandan 122.184.55.148 port 37870 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.158
country_id: 6252001
description:
Nov  2 03:27:06 host2 dovecot[2287296]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=199.45.154.158, lip=66.85.158.92, TLS: read(size=713) failed: Connection reset by peer, session=<u/wokI9COMPHLZqe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.184.55.148
country_id: 1269750
description:
Nov  2 03:27:48 host2 sshd[2468759]: Disconnected from invalid user marcela 122.184.55.148 port 39444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-02 03:27:16 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (lazed) [73.145.107.251]:41796: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Nov  2 03:29:03 host2 sshd[2470044]: Disconnected from invalid user david 154.221.22.203 port 53190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-02 03:29:28 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:49306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-11-02 03:29:20 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:38114: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.184.55.148
country_id: 1269750
description:
Nov  2 03:33:11 host2 sshd[2473934]: Disconnected from invalid user nobel 122.184.55.148 port 45742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-02 03:34:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55069: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Nov  2 03:34:27 host2 sshd[2475160]: Disconnected from invalid user market 152.32.172.117 port 52296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.186.92
country_id: 357994
description:
2025-11-02 03:35:57 dovecot_plain authenticator failed for (ahethu) [154.177.186.92]:35338: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Nov  2 03:37:37 host2 sshd[2478263]: Disconnected from invalid user oficina 116.193.191.46 port 50516 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 03:40:02 host2 sshd[2480986]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.117
country_id: 1819730
description:
Nov  2 03:39:47 host2 sshd[2480601]: Disconnected from invalid user eli 152.32.172.117 port 50408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-02 03:40:38 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:43325: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Nov  2 03:45:07 host2 sshd[2486690]: Disconnected from invalid user sdr 152.32.172.117 port 47450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Nov  2 03:44:20 host2 sshd[2485256]: Disconnected from invalid user bruce 116.193.191.46 port 43126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  2 03:44:45 host2 dovecot[2479779]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<BYY/z49CWMGLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.208
country_id: 1880251
description:
Nov  2 03:47:18 host2 sshd[2489600]: Disconnected from invalid user r2 45.78.217.208 port 41450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Nov  2 03:49:54 host2 sshd[2492337]: Disconnected from invalid user kelvin 116.193.191.46 port 51858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2025-11-02 03:53:27 dovecot_login authenticator failed for (ADMIN) [185.225.28.227]:59195: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.208
country_id: 1880251
description:
Nov  2 03:55:17 host2 sshd[2498466]: Disconnected from invalid user ltq 45.78.217.208 port 51508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-02 03:56:10 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (popis) [98.192.114.251]:58821: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-02 03:57:51 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:60008: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.208
country_id: 1880251
description:
Nov  2 03:57:58 host2 sshd[2501264]: Disconnected from invalid user sdr 45.78.217.208 port 54542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 03:59:17 host2 sshd[2502677]: Disconnected from invalid user user 2.57.121.25 port 6959 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 04:00:46 host2 sshd[2504188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Nov  2 04:03:41 host2 sshd[2507462]: Disconnected from invalid user xr 116.193.191.46 port 53054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.253
country_id: 3469034
description:
2025-11-02 04:12:24 dovecot_login authenticator failed for (ADMIN) [188.241.177.253]:43672: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 04:17:50 host2 sshd[2524982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-02 04:25:32 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (intaggly) [174.59.253.88]:38300: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 04:28:46 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tylarreval) [87.103.126.54]:48462: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.243.218.218
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 136.243.218.218 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.53.70
country_id: 6252001
description:
[2025-11-02 04:38:32 +0530] info [cpaneld] 104.234.53.70 - info@idesignvector.com "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.36.41
country_id: 6251999
description:
2025-11-02 04:39:23 dovecot_login authenticator failed for (ADMIN) [191.96.36.41]:15892: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-02 04:40:57 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (trable) [73.13.220.220]:49408: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.188.189.7
country_id: 6252001
description:
Nov  2 04:41:46 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.188.189.7, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YBgzm5BCFt40vL0H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-02 04:42:22 dovecot_plain authenticator failed for (verosew) [65.20.251.71]:43271: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-02 04:56:06 dovecot_plain authenticator failed for (clins) [65.20.205.197]:54363: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.227.110
country_id: 6252001
description:
Nov  2 04:58:44 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.206.227.110, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0iLb15BCPseszuNu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov  2 04:59:41 host2 sshd[2583460]: Disconnected from invalid user manoj 137.184.202.107 port 41646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.58
country_id: 1814991
description:
2025-11-02 05:02:54 dovecot_login authenticator failed for (ADMIN) [188.241.80.58]:1686: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Nov  2 05:03:36 host2 sshd[2588387]: Disconnected from invalid user tios 155.248.164.42 port 56522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-11-02 05:05:21 dovecot_plain authenticator failed for (atimus) [87.121.76.190]:57597: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov  2 05:06:50 host2 sshd[2591945]: Disconnected from invalid user sunyan 137.184.202.107 port 54406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov  2 05:06:56 host2 sshd[2591999]: Disconnected from invalid user user 125.21.53.232 port 48288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.186.92
country_id: 357994
description:
2025-11-02 05:06:44 dovecot_plain authenticator failed for (karifts) [154.177.186.92]:55940: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.202.107
country_id: 6252001
description:
Nov  2 05:08:00 host2 sshd[2593053]: Disconnected from invalid user luan 137.184.202.107 port 33540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov  2 05:09:52 host2 sshd[2594856]: Disconnected from invalid user name 125.21.53.232 port 35132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov  2 05:09:20 host2 sshd[2594382]: Disconnected from invalid user user1 137.184.202.107 port 49626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.109.153
country_id: 6252001
description:
Nov  2 05:10:35 host2 sshd[2595724]: Disconnected from invalid user admin 162.240.109.153 port 52280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.53.232
country_id: 1269750
description:
Nov  2 05:11:17 host2 sshd[2596391]: Disconnected from invalid user ubuntu 125.21.53.232 port 55670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov  2 05:12:06 host2 sshd[2597272]: Disconnected from invalid user marwan 137.184.202.107 port 35388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.252.190.249
country_id: 298795
description:
Nov  2 05:12:42 host2 sshd[2597819]: Disconnected from invalid user naemon 89.252.190.249 port 59374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.252.190.249
country_id: 298795
description:
Nov  2 05:13:56 host2 sshd[2598974]: Disconnected from invalid user vtiger 89.252.190.249 port 56304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Nov  2 05:14:16 host2 sshd[2599357]: Disconnected from invalid user practicas 155.248.164.42 port 38464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.105.133
country_id: 3469034
description:
Nov  2 05:14:26 host2 sshd[2599496]: Disconnected from invalid user ubuntu 191.242.105.133 port 54392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.252.190.249
country_id: 298795
description:
Nov  2 05:15:09 host2 sshd[2600360]: Disconnected from invalid user ron 89.252.190.249 port 35752 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 05:15:18 host2 sshd[2600614]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.109.153
country_id: 6252001
description:
Nov  2 05:15:20 host2 sshd[2600624]: Disconnected from invalid user echo 162.240.109.153 port 58322 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.53.70
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 104.234.53.70 - info@idesignvector.com "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-02 05:17:10 dovecot_plain authenticator failed for (lisers) [216.194.174.27]:2313: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.242.105.133
country_id: 3469034
description:
Nov  2 05:18:40 host2 sshd[2603859]: Disconnected from invalid user frolov 191.242.105.133 port 57768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.3.253.156
country_id: 6252001
description:
Nov  2 05:18:44 host2 sshd[2603899]: Disconnected from invalid user dbase 20.3.253.156 port 35140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.228.15
country_id: 1861060
description:
Nov  2 05:18:51 host2 sshd[2603950]: Disconnected from invalid user echo 118.194.228.15 port 59202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.228.15
country_id: 1861060
description:
Nov  2 05:20:31 host2 sshd[2605837]: Disconnected from invalid user ubuntu 118.194.228.15 port 50570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.3.253.156
country_id: 6252001
description:
Nov  2 05:22:51 host2 sshd[2608180]: Disconnected from invalid user aiftp 20.3.253.156 port 51778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.228.15
country_id: 1861060
description:
Nov  2 05:22:18 host2 sshd[2607683]: Disconnected from invalid user green 118.194.228.15 port 33090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.151
country_id: 3077311
description:
2025-11-02 05:24:02 dovecot_login authenticator failed for (ADMIN) [212.102.39.151]:16273: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.228.15
country_id: 1861060
description:
Nov  2 05:24:01 host2 sshd[2609207]: Disconnected from invalid user user 118.194.228.15 port 47110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-02 05:24:32 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:46230: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-02 05:24:11 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:59112: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.3.253.156
country_id: 6252001
description:
Nov  2 05:25:30 host2 sshd[2610819]: Disconnected from invalid user student09 20.3.253.156 port 39776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.105.133
country_id: 3469034
description:
Nov  2 05:26:06 host2 sshd[2611480]: Disconnected from invalid user echo 191.242.105.133 port 35196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.3.253.156
country_id: 6252001
description:
Nov  2 05:28:25 host2 sshd[2614309]: Disconnected from invalid user perforce 20.3.253.156 port 40338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-11-02 05:30:40 dovecot_plain authenticator failed for (deren) [102.53.15.180]:43986: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 05:41:42 host2 sshd[2628590]: Disconnected from invalid user admin 2.57.121.112 port 60560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 05:41:31 host2 sshd[2628411]: Disconnected from invalid user admin 2.57.121.112 port 17666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2025-11-02 05:43:27 dovecot_login authenticator failed for (nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:36460: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-02 05:43:16 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:43864: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.29
country_id: 6251999
description:
2025-11-02 05:45:36 dovecot_login authenticator failed for (ADMIN) [66.56.80.29]:60830: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-02 05:46:53 dovecot_plain authenticator failed for (slycle) [46.8.240.26]:48506: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 05:48:46 host2 sshd[2636263]: Disconnected from invalid user user 2.57.121.25 port 32868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 05:49:09 host2 sshd[2636621]: Disconnected from invalid user user 2.57.121.25 port 6058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-02 05:51:56 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (posts) [73.129.57.71]:47486: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 05:53:02 host2 sshd[2640931]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-02 05:55:44 dovecot_plain authenticator failed for (frarcalize) [88.207.210.23]:61905: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-02 06:01:41 dovecot_plain authenticator failed for (gulpagely) [5.32.107.6]:41026: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-02 06:04:07 dovecot_plain authenticator failed for (liante) [80.227.147.94]:38955: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.38.104.3
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.38.104.3 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-11-02 06:06:23 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (toicarti) [24.15.216.41]:41922: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.229
country_id: 6252001
description:
2025-11-02 06:07:46 dovecot_login authenticator failed for (ADMIN) [102.129.252.229]:35760: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.95.177.133
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 3.95.177.133: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.126.17
country_id: 337996
description:
Nov  2 06:12:04 host2 sshd[2662974]: Disconnected from invalid user hotline 196.189.126.17 port 56664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-02 06:13:38 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (somitialit) [196.47.172.253]:33202: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov  2 06:14:42 host2 sshd[2666124]: Disconnected from invalid user sami 101.100.194.199 port 59754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov  2 06:16:41 host2 sshd[2668306]: Disconnected from invalid user utility 101.100.194.199 port 45866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.100.194.199
country_id: 1880251
description:
Nov  2 06:18:03 host2 sshd[2669819]: Disconnected from invalid user postgres 101.100.194.199 port 46980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov  2 06:19:25 host2 sshd[2671234]: Disconnected from invalid user rabbit 101.100.194.199 port 55764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.154
country_id: 1643084
description:
Nov  2 06:20:09 host2 sshd[2672065]: Disconnected from invalid user sneha 103.217.145.154 port 52812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov  2 06:20:41 host2 sshd[2672635]: Disconnected from invalid user flw 195.250.72.168 port 51948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.250.72.168
country_id: 174982
description:
Nov  2 06:23:43 host2 sshd[2676214]: Disconnected from invalid user cpp 195.250.72.168 port 56928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.154
country_id: 1643084
description:
Nov  2 06:25:51 host2 sshd[2678724]: Disconnected from invalid user dogs 103.217.145.154 port 37070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.8
country_id: 3175395
description:
2025-11-02 06:27:27 dovecot_login authenticator failed for (ADMIN) [156.146.41.8]:40812: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov  2 06:29:57 host2 sshd[2682937]: Disconnected from invalid user hotline 195.250.72.168 port 41234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-11-02 06:30:47 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (unduclary) [98.192.74.183]:59988: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.154
country_id: 1643084
description:
Nov  2 06:31:13 host2 sshd[2684581]: Disconnected from invalid user uap 103.217.145.154 port 59668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.145.154
country_id: 1643084
description:
Nov  2 06:35:03 host2 sshd[2688754]: Disconnected from invalid user sami 103.217.145.154 port 44100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.126.17
country_id: 337996
description:
Nov  2 06:36:27 host2 sshd[2690213]: Disconnected from invalid user ftpuser 196.189.126.17 port 33528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.163
country_id: 6252001
description:
Nov  2 06:41:26 host2 dovecot[2479779]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XiYfR5JCLdnN0h+j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-02 06:41:31 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (dress) [174.59.253.88]:42876: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-02 06:44:48 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (crambess) [73.197.194.98]:59928: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.88.31
country_id: 2750405
description:
2025-11-02 06:47:26 dovecot_plain authenticator failed for ([196.251.88.31]) [196.251.88.31]:55901: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.214
country_id: 6252001
description:
2025-11-02 06:47:40 dovecot_login authenticator failed for (ADMIN) [212.56.54.214]:8388: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.88.31
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.251.88.31 - lezzarotech "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.126.17
country_id: 337996
description:
Nov  2 06:48:28 host2 sshd[2703071]: Disconnected from invalid user caja1 196.189.126.17 port 50658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.88.31
country_id: 2750405
description:
2025-11-02 06:48:31 dovecot_plain authenticator failed for ([196.251.88.31]) [196.251.88.31]:58236: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.88.31
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.251.88.31 - lezzarotechcom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 06:50:16 host2 sshd[2704944]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.126.17
country_id: 337996
description:
Nov  2 06:50:28 host2 sshd[2705128]: Disconnected from invalid user parts 196.189.126.17 port 52218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-02 06:55:09 dovecot_plain authenticator failed for (thyabdaets) [84.238.92.245]:60423: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 06:56:37 host2 sshd[2711957]: Disconnected from invalid user admin 2.57.121.112 port 38199 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.126.17
country_id: 337996
description:
Nov  2 07:00:28 host2 sshd[2715822]: Disconnected from invalid user mobile 196.189.126.17 port 56362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-11-02 07:00:39 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (initcoric) [98.193.112.85]:37626: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-02 07:01:51 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (sniallise) [73.224.171.101]:36708: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-02 07:02:53 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51411: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 200.214.6.187
country_id: 3469034
description:
Nov  2 07:05:22 host2 pure-ftpd[2721678]: (?@200.214.6.187) [INFO] New connection from 200.214.6.187


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.214.6.187
country_id: 3469034
description:
Nov  2 07:05:24 host2 sshd[2721677]: Invalid user mohkaduwela@epid.gov.lk from 200.214.6.187 port 53731


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.214.6.187
country_id: 3469034
description:
Nov  2 07:05:37 host2 dovecot[2479779]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mohkaduwela@epid.gov.lk>, method=PLAIN, rip=200.214.6.187, lip=66.85.158.91, TLS, session=<+TGAnZJCYt/I1ga7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 200.214.6.187
country_id: 3469034
description:
Nov  2 07:05:39 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=200.214.6.187, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PSvHnZJCFtzI1ga7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 200.214.6.187
country_id: 3469034
description:
Nov  2 07:08:45 host2 dovecot[2479779]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=200.214.6.187, lip=66.85.158.91, TLS handshaking, session=<j8POqJJCc+TI1ga7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.31
country_id: 6252001
description:
2025-11-02 07:09:02 dovecot_login authenticator failed for (ADMIN) [181.41.206.31]:45138: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-02 07:09:43 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (noncitess) [71.224.169.28]:51178: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.81.139.100
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.81.139.100: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.152
country_id: 2635167
description:
Nov  2 07:18:22 host2 dovecot[2479779]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.152, lip=66.85.158.91, TLS, session=<+Hg3y5JCp5VX7LCY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-02 07:18:28 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:54441: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
country_id: 290557
description:
2025-11-02 07:18:36 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:33568: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-02 07:20:21 dovecot_plain authenticator failed for (boxylars) [102.53.15.18]:45511: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.85
country_id: 6252001
description:
Nov  2 07:22:48 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.85, lip=66.85.158.91, TLS: Connection closed, session=<Q6UX25JC1NDHLZtV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Nov  2 07:22:53 host2 sshd[2740547]: Disconnected from invalid user 23 137.184.145.163 port 58220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Nov  2 07:25:58 host2 sshd[2743505]: Disconnected from invalid user mcadmin 137.184.145.163 port 46006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Nov  2 07:26:24 host2 sshd[2743958]: Disconnected from invalid user zzw 103.172.205.208 port 51080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov  2 07:26:37 host2 sshd[2744203]: Disconnected from invalid user test 159.89.161.111 port 59196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Nov  2 07:27:02 host2 sshd[2744751]: Disconnected from invalid user lucas 137.184.145.163 port 35866 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 07:28:02 host2 sshd[2745588]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-02 07:28:36 dovecot_plain authenticator failed for (poses) [65.20.186.177]:59440: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Nov  2 07:29:16 host2 sshd[2746697]: Disconnected from invalid user santosh 137.184.145.163 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov  2 07:29:49 host2 sshd[2747135]: Disconnected from invalid user aryan 159.89.161.111 port 36446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 07:30:13 host2 sshd[2747676]: Disconnected from invalid user user 2.57.121.25 port 55371 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov  2 07:31:27 host2 sshd[2748916]: Disconnected from invalid user 23 159.89.161.111 port 33976 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov  2 07:31:58 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS handshaking: Connection closed, session=</ijg+5JCILq4aYtG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.161.111
country_id: 1269750
description:
Nov  2 07:33:05 host2 sshd[2750632]: Disconnected from invalid user mcadmin 159.89.161.111 port 58940 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov  2 07:32:18 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZrwP/ZJCtHO4aYtG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Nov  2 07:33:40 host2 sshd[2751214]: Disconnected from invalid user facai 103.172.205.208 port 45162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.64
country_id: 6252001
description:
Nov  2 07:33:47 host2 dovecot[2479779]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.64, lip=66.85.158.91, TLS, session=<BF5dApNC9PfN0h9A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-02 07:36:58 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (spechical) [71.62.34.216]:40064: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.208
country_id: 1643084
description:
Nov  2 07:38:18 host2 sshd[2756184]: Disconnected from invalid user wajid 103.172.205.208 port 53830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-02 07:39:14 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:46326: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-02 07:39:19 dovecot_plain authenticator failed for (momixic) [65.20.251.71]:41831: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-02 07:39:23 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:33889: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-11-02 07:43:49 dovecot_plain authenticator failed for (prophass) [102.53.15.180]:37396: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.1.180
country_id: 2635167
description:
2025-11-02 07:47:58 dovecot_plain authenticator failed for (wicomende) [46.101.1.180]:45368: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-02 07:49:08 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48380: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-11-02 07:49:28 dovecot_login authenticator failed for host-95-229-5-248.business.telecomitalia.it [95.229.5.248]:44566: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.224
country_id: 2635167
description:
2025-11-02 07:53:25 dovecot_login authenticator failed for (ADMIN) [45.133.172.224]:53652: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 60.240.6.187
country_id: 2077456
description:
Nov  2 07:55:22 host2 sshd[2776814]: Disconnected from invalid user facai 60.240.6.187 port 59194 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.205
country_id: 2635167
description:
Nov  2 07:56:45 host2 pure-ftpd[2778408]: (?@185.247.137.205) [INFO] New connection from 185.247.137.205


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.6
country_id: 6252001
description:
Nov  2 07:57:35 host2 dovecot[2479779]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, TLS, session=<72qAV5NC6tLCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.1.180
country_id: 2635167
description:
2025-11-02 07:58:03 dovecot_plain authenticator failed for (nonychi) [46.101.1.180]:59546: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 60.240.6.187
country_id: 2077456
description:
Nov  2 08:06:12 host2 sshd[2789516]: Disconnected from invalid user user2 60.240.6.187 port 39536 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.78
country_id: 6252001
description:
Nov  2 08:07:30 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=199.45.155.78, lip=66.85.158.92, TLS: Connection closed, session=<G+rwepNCmJPHLZtO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 08:11:38 host2 sshd[2795799]: Disconnected from invalid user admin 2.57.121.112 port 52106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-02 08:13:17 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:44926: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.255.71
country_id: 6252001
description:
2025-11-02 08:17:10 dovecot_login authenticator failed for (ADMIN) [191.96.255.71]:54633: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-02 08:22:16 dovecot_plain authenticator failed for (undiolve) [24.104.225.201]:53692: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-02 08:23:21 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (dicerum) [73.88.196.91]:40482: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.111
country_id: 6252001
description:
Nov  2 08:24:35 host2 dovecot[2479779]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tnsOuJNC4MXN0h9v>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 08:25:37 host2 sshd[2810591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 08:28:45 host2 sshd[2813501]: Disconnected from invalid user squid 2.57.121.112 port 61596 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.60
country_id: 6252001
description:
Nov  2 08:29:26 host2 pure-ftpd[2814194]: (?@205.210.31.60) [INFO] New connection from 205.210.31.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-11-02 08:36:41 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (gagast) [76.31.164.124]:55986: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-02 08:37:48 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:35633: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.204
country_id: 798544
description:
2025-11-02 08:37:48 dovecot_login authenticator failed for (ADMIN) [138.199.59.204]:60814: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-02 08:37:55 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:57348: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-11-02 08:40:15 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (unres) [71.235.225.181]:41988: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-02 08:49:59 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unwhi) [217.215.74.195]:52720: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-02 08:55:18 dovecot_plain authenticator failed for 81-234-121-57-no600.tbcn.telia.com (tusigar) [81.234.121.57]:45152: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-02 08:55:33 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:56378: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2025-11-02 09:04:04 dovecot_login authenticator failed for (nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:58062: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 09:03:30 host2 sshd[2854592]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-02 09:04:24 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:35314: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 09:09:40 host2 sshd[2861431]: Disconnected from invalid user user 2.57.121.25 port 47011 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov  2 09:10:05 host2 dovecot[2479779]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, session=<YZPCWpRCMv/CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-02 09:11:41 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (kievabble) [68.193.149.88]:50083: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-02 09:14:43 dovecot_plain authenticator failed for (unmelikent) [65.20.250.163]:59753: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-02 09:15:21 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (aunamphial) [73.183.74.177]:58144: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.240
country_id: 6252001
description:
Nov  2 09:15:19 host2 dovecot[2479779]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cFx/bZRCYtjG6xjw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.13
country_id: 2562770
description:
2025-11-02 09:19:31 dovecot_login authenticator failed for (ADMIN) [176.125.230.13]:41986: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-02 09:19:49 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (table) [76.145.10.140]:52606: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-02 09:20:53 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (aximicans) [68.60.77.128]:52406: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-02 09:20:56 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (perable) [98.192.114.251]:56405: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.44.143.75
country_id: 3175395
description:
2025-11-02 09:24:23 dovecot_plain authenticator failed for 93-44-143-75.ip97.fastwebnet.it (supter) [93.44.143.75]:52466: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 09:26:25 host2 sshd[2880794]: Disconnected from invalid user admin 2.57.121.112 port 36171 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-02 09:30:37 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (frizes) [73.196.144.25]:46386: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov  2 09:33:20 host2 sshd[2888480]: Disconnected from invalid user line 83.118.24.18 port 43246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.118.24.18
country_id: 1605651
description:
Nov  2 09:34:53 host2 sshd[2890006]: Disconnected from invalid user gray 83.118.24.18 port 44980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-02 09:35:56 dovecot_plain authenticator failed for (cloxing) [65.20.155.223]:34121: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov  2 09:36:58 host2 sshd[2892548]: Disconnected from invalid user joel 213.6.203.226 port 33175 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov  2 09:36:32 host2 sshd[2892057]: Disconnected from invalid user testftp 83.118.24.18 port 32962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov  2 09:38:11 host2 sshd[2893781]: Disconnected from invalid user sales 83.118.24.18 port 51610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov  2 09:38:26 host2 sshd[2894027]: Disconnected from invalid user herve 213.6.203.226 port 53484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Nov  2 09:39:41 host2 sshd[2895539]: Disconnected from invalid user git 213.6.203.226 port 61500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.29
country_id: 3057568
description:
2025-11-02 09:39:52 dovecot_login authenticator failed for (ADMIN) [149.102.232.29]:40299: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.121
country_id: 6252001
description:
Nov  2 09:40:04 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.121, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<23QBxpRCWNai2JZ5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.121
country_id: 6252001
description:
Nov  2 09:40:25 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.121, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<wwhBx5RCRvKi2JZ5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.198
country_id: 6252001
description:
Nov  2 09:40:46 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</8B/yJRCkNWTuYTG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov  2 09:40:55 host2 sshd[2897065]: Disconnected from invalid user robot 213.6.203.226 port 37603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov  2 09:40:57 host2 sshd[2897071]: Disconnected from invalid user ftpuser 190.129.122.185 port 56948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.135
country_id: 130758
description:
Nov  2 09:41:25 host2 sshd[2897705]: Disconnected from invalid user hc 185.50.38.135 port 52524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.135
country_id: 130758
description:
Nov  2 09:45:03 host2 sshd[2901864]: Disconnected from invalid user sylwia 185.50.38.135 port 58094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-02 09:44:25 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (wiseutute) [68.52.119.193]:59374: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-02 09:44:51 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (unchha) [196.47.172.253]:49619: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.121
country_id: 6252001
description:
Nov  2 09:46:11 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.121, lip=66.85.158.92, TLS, session=<2BTd25RCbP+i2JZ5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.170.232.33
country_id: 6252001
description:
Nov  2 09:47:59 host2 sshd[2905207]: Disconnected from invalid user divya 107.170.232.33 port 53838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.50.38.135
country_id: 130758
description:
Nov  2 09:47:39 host2 sshd[2904855]: Disconnected from invalid user enrique 185.50.38.135 port 36042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov  2 09:48:23 host2 sshd[2905710]: Disconnected from invalid user oracle 190.129.122.185 port 56274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-02 09:49:19 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (unatorress) [73.230.86.50]:53878: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov  2 09:50:09 host2 sshd[2907693]: Disconnected from invalid user jmy 103.153.190.105 port 45220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.170.232.33
country_id: 6252001
description:
Nov  2 09:50:35 host2 sshd[2908265]: Disconnected from invalid user ftpuser 107.170.232.33 port 59856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Nov  2 09:51:29 host2 sshd[2909313]: Disconnected from invalid user enrique 103.153.190.105 port 46832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov  2 09:53:15 host2 sshd[2911333]: Disconnected from invalid user sylwia 190.129.122.185 port 54672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov  2 09:54:58 host2 sshd[2913489]: Disconnected from invalid user ehsan 190.129.122.185 port 34396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.170.232.33
country_id: 6252001
description:
Nov  2 09:54:27 host2 sshd[2912444]: Disconnected from invalid user sylwia 107.170.232.33 port 17218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.170.232.33
country_id: 6252001
description:
Nov  2 09:55:27 host2 sshd[2914131]: Disconnected from invalid user pbarros 107.170.232.33 port 41998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.122.185
country_id: 3923057
description:
Nov  2 09:56:43 host2 sshd[2915433]: Disconnected from invalid user kelly 190.129.122.185 port 43788 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.48.182
country_id: 6252001
description:
Nov  2 10:11:28 host2 pure-ftpd[2932520]: (?@20.169.48.182) [INFO] New connection from 20.169.48.182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.126
country_id: 294640
description:
2025-11-02 10:15:44 dovecot_plain authenticator failed for (reafonia) [109.226.14.126]:57323: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  2 10:18:19 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<t6PITpVCfJsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  2 10:27:41 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<j8s/cJVC1O0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  2 10:28:50 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<dbZldJVCboADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.173
country_id: 798549
description:
2025-11-02 10:29:04 dovecot_login authenticator failed for (ADMIN) [91.90.120.173]:21551: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Nov  2 10:30:10 host2 sshd[2952065]: Disconnected from invalid user apagar 54.38.52.18 port 51648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.208
country_id: 6252001
description:
Nov  2 10:32:23 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.208, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bKgZgZVClMai2JbQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-02 10:33:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53534: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.208
country_id: 6252001
description:
Nov  2 10:33:28 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.208, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QZX3hJVCmP2i2JbQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-02 10:33:59 dovecot_plain authenticator failed for (nuess) [65.20.204.193]:56888: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.210.122
country_id: 2802361
description:
Nov  2 10:34:11 host2 pure-ftpd[2956044]: (?@34.76.210.122) [INFO] New connection from 34.76.210.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Nov  2 10:34:56 host2 sshd[2956689]: Disconnected from invalid user nexus 54.38.52.18 port 50674 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.118.80
country_id: 1733045
description:
[2025-11-02 10:37:03 +0530] info [whostmgrd] 203.106.118.80 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.52.18
country_id: 798544
description:
Nov  2 10:38:18 host2 sshd[2960579]: Disconnected from invalid user tera 54.38.52.18 port 52818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.208
country_id: 6252001
description:
Nov  2 10:39:27 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.208, lip=66.85.158.91, TLS, session=<S+5cmpVC2vui2JbQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 10:40:15 host2 sshd[2963156]: Disconnected from invalid user admin 2.57.121.112 port 40339 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Nov  2 10:40:34 host2 sshd[2963492]: Disconnected from invalid user gm 128.199.168.119 port 59210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-11-02 10:42:53 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (spator) [73.161.96.107]:47466: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.38.185
country_id: 290557
description:
2025-11-02 10:42:13 dovecot_plain authenticator failed for (ambulateou) [5.31.38.185]:53074: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-11-02 10:42:15 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (khaut) [95.229.5.248]:59062: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Nov  2 10:42:16 host2 sshd[2965269]: Disconnected from invalid user testuser 128.199.168.119 port 60598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.168.119
country_id: 1880251
description:
Nov  2 10:43:38 host2 sshd[2966564]: Disconnected from invalid user corporate 128.199.168.119 port 33728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-02 10:44:11 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (olophyst) [74.218.95.154]:34818: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
country_id: 3017382
description:
2025-11-02 10:47:26 dovecot_plain authenticator failed for lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (unfult) [80.14.169.244]:33072: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 10:48:03 host2 sshd[2971772]: Disconnected from invalid user user 2.57.121.25 port 33353 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.197.111
country_id: 6251999
description:
2025-11-02 10:57:18 dovecot_login authenticator failed for (ADMIN) [179.61.197.111]:17533: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
country_id: 99237
description:
2025-11-02 11:05:24 dovecot_plain authenticator failed for (inoid) [65.20.204.164]:52745: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.135
country_id: 6251999
description:
2025-11-02 11:21:32 dovecot_login authenticator failed for (ADMIN) [149.22.95.135]:45734: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Nov  2 11:22:16 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.64, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CKl2M5ZC3N6TuYRA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.168.121.119
country_id: 6252001
description:
Nov  2 11:26:32 host2 pure-ftpd[3016406]: (?@20.168.121.119) [INFO] New connection from 20.168.121.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-02 11:35:29 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (chenting) [73.213.237.28]:59126: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-02 11:36:56 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:53818: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-02 11:37:07 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:60516: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.193
country_id: 1733045
description:
2025-11-02 11:36:37 dovecot_login authenticator failed for ([49.124.159.193]) [49.124.159.193]:59122: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:36:39 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<4oHyZpZCUIYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.138.214
country_id: 290557
description:
2025-11-02 11:36:53 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:38882: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.219.97.177
country_id: 2782113
description:
Nov  2 11:38:16 host2 sshd[3028605]: Disconnected from invalid user demo 193.219.97.177 port 36520 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:38:58 host2 dovecot[2894624]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<XFc6b5ZCnNADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-11-02 11:40:09 dovecot_plain authenticator failed for (poidasers) [5.11.221.119]:38036: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:40:08 host2 dovecot[2894624]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<lyNbc5ZCZo0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:40:12 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<UM6gc5ZCjNoDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:42:15 host2 dovecot[2894624]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<uVzvepZC/tsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:42:27 host2 dovecot[2894624]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<8LCke5ZCOOIDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.219.97.177
country_id: 2782113
description:
Nov  2 11:42:10 host2 sshd[3032661]: Disconnected from invalid user tho 193.219.97.177 port 33384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.106
country_id: 2661886
description:
2025-11-02 11:43:55 dovecot_login authenticator failed for (ADMIN) [212.112.19.106]:47139: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:43:58 host2 dovecot[2894624]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<2DUdgZZCKLIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:44:23 host2 dovecot[2894624]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<xGqWgpZC7N4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:45:14 host2 dovecot[2894624]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<cBCchZZClo4DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:45:49 host2 dovecot[2894624]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<1KKuh5ZC8OgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-02 11:46:28 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:39754: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-02 11:46:42 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:30805: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-02 11:47:01 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:38656: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-02 11:46:25 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:55946: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.219.97.177
country_id: 2782113
description:
Nov  2 11:47:40 host2 sshd[3038900]: Disconnected from invalid user mindware 193.219.97.177 port 42872 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 11:47:44 host2 dovecot[2894624]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<FX6NjpZClpwDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.219.97.177
country_id: 2782113
description:
Nov  2 11:48:50 host2 sshd[3039997]: Disconnected from invalid user metro 193.219.97.177 port 50702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.219.97.177
country_id: 2782113
description:
Nov  2 11:50:04 host2 sshd[3041393]: Disconnected from invalid user test 193.219.97.177 port 46360 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-02 11:54:32 dovecot_plain authenticator failed for (impelvane) [102.53.15.18]:53200: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.198.62.20
country_id: 6252001
description:
2025-11-02 11:54:41 dovecot_plain authenticator failed for c-98-198-62-20.hsd1.tx.comcast.net (avolfer) [98.198.62.20]:56290: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-02 11:56:24 dovecot_plain authenticator failed for (derolic) [87.200.171.25]:48247: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-02 11:56:33 dovecot_plain authenticator failed for (nucled) [122.187.221.130]:48534: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-02 11:58:06 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:47094: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-02 11:57:33 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (cauddlicas) [98.40.101.10]:49024: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-02 11:57:57 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (snuffing) [73.13.220.220]:45104: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-02 11:58:14 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:51500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.237.228
country_id: 6251999
description:
Nov  2 12:01:59 host2 dovecot[2894624]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=178.128.237.228, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<CFuHwZZCIJuygO3k>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-02 12:04:41 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (runise) [73.213.237.28]:39550: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-02 12:05:39 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:41514: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-02 12:06:23 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:55756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-02 12:06:43 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:38372: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-02 12:06:19 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:37057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.103.15
country_id: 6252001
description:
2025-11-02 12:09:32 dovecot_login authenticator failed for dedicated-zap828075-1.zap-srv.com (ADMIN) [191.96.103.15]:48329: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-02 12:13:44 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:35152: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-02 12:14:00 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:46345: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 12:21:25 host2 sshd[3077725]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-02 12:24:59 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:33963: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-02 12:25:05 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:27036: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-11-02 12:27:02 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:34182: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-02 12:26:41 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (podlies) [73.196.144.25]:44448: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-02 12:27:30 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:39109: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.193
country_id: 1733045
description:
2025-11-02 12:27:49 dovecot_login authenticator failed for ([49.124.159.193]) [49.124.159.193]:34510: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.29
country_id: 2589581
description:
2025-11-02 12:27:49 dovecot_login authenticator failed for (ADMIN) [176.125.228.29]:10285: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-02 12:28:53 dovecot_plain authenticator failed for (podiace) [65.20.205.197]:50171: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.156
country_id: 1733045
description:
2025-11-02 12:28:17 dovecot_login authenticator failed for ([49.124.154.156]) [49.124.154.156]:44226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-02 12:29:15 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (racidate) [217.215.74.195]:33674: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-02 12:29:19 dovecot_plain authenticator failed for (guing) [65.20.164.137]:41322: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-02 12:31:48 dovecot_plain authenticator failed for (preeterers) [12.150.243.22]:23913: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.191.235
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 165.22.191.235 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 12:44:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (thona) [87.103.126.54]:61607: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-02 12:47:49 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:39141: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-11-02 12:47:49 dovecot_login authenticator failed for ([103.67.152.201]) [103.67.152.201]:53366: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-02 12:48:07 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:48740: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-02 12:48:29 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:52720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.248.47
country_id: 2921044
description:
Nov  2 12:50:03 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.92.248.47, lip=66.85.158.91, TLS, session=<Ls5nbZdC2qOkXPgv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.248.47
country_id: 2921044
description:
Nov  2 12:50:06 host2 dovecot[3096982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=164.92.248.47, lip=66.85.158.91, session=</l+fbZdCMKSkXPgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-11-02 12:50:49 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (loghtouty) [73.55.194.114]:35700: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov  2 12:54:01 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<MTCae5dCPKWLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.111
country_id: 6252001
description:
Nov  2 12:54:08 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<h+QBfJdCy9CTuYRv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-02 12:55:14 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:11452: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-02 12:55:21 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:40605: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.138
country_id: 6252001
description:
2025-11-02 12:55:37 dovecot_login authenticator failed for (ADMIN) [102.129.153.138]:57862: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-02 12:57:14 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:35362: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-02 12:57:21 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:58007: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-02 12:57:41 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:60452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-02 12:57:43 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:63281: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-02 12:59:07 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (ovetolasia) [217.215.74.195]:35606: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 12:59:12 host2 sshd[3120066]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-11-02 13:00:47 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:39335: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-02 13:00:49 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:36890: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-02 13:01:05 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (propla) [73.129.57.71]:35838: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-02 13:00:27 dovecot_login authenticator failed for ([65.20.155.223]) [65.20.155.223]:40404: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-02 13:01:01 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:44682: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-02 13:01:02 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:55894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-02 13:00:42 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:37073: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.67.28.239
country_id: 1643084
description:
2025-11-02 13:01:10 dovecot_login authenticator failed for ([36.67.28.239]) [36.67.28.239]:50425: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-02 13:01:23 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (scally) [73.129.57.71]:37162: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-02 13:01:30 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:39060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.74
country_id: 1819730
description:
Nov  2 13:02:12 host2 sshd[3123402]: Disconnected from invalid user sysadmin 103.145.145.74 port 58182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.136
country_id: 6252001
description:
Nov  2 13:07:17 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.136, lip=66.85.158.91, session=<p3ULq5dCiZfDuEyI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.74
country_id: 1819730
description:
Nov  2 13:07:43 host2 sshd[3129826]: Disconnected from invalid user freeswitch 103.145.145.74 port 59636 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.141
country_id: 6252001
description:
Nov  2 13:07:06 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.141, lip=66.85.158.91, session=<Pk5rqpdCQYbDuEyN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.74
country_id: 1819730
description:
Nov  2 13:09:11 host2 sshd[3131315]: Disconnected from invalid user leon 103.145.145.74 port 60002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-02 13:09:35 dovecot_plain authenticator failed for (conisean) [24.104.225.201]:35986: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-02 13:09:58 dovecot_plain authenticator failed for (inalne) [154.144.243.93]:55672: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.138
country_id: 6252001
description:
Nov  2 13:11:08 host2 dovecot[3096982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.138, lip=66.85.158.91, session=<fOXTuJdCqZzDuEyK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.208
country_id: 6252001
description:
Nov  2 13:11:11 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.208, lip=66.85.158.91, session=<OrUDuZdCv87DuEzQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  2 13:12:13 host2 sshd[3134441]: Disconnected from invalid user rocio 62.60.131.157 port 56359 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov  2 13:15:05 host2 sshd[3137346]: Disconnected from invalid user matrix 20.102.116.25 port 40880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov  2 13:14:53 host2 sshd[3136918]: Disconnected from invalid user client 102.88.137.80 port 1147 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.29
country_id: 2542007
description:
Nov  2 13:16:54 host2 sshd[3139231]: Disconnected from invalid user postgres 81.192.46.29 port 42848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov  2 13:16:26 host2 sshd[3138854]: Disconnected from invalid user hduser 20.102.116.25 port 46806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.105.153
country_id: 1880251
description:
Nov  2 13:16:29 host2 sshd[3138866]: Disconnected from invalid user deploy 165.22.105.153 port 59824 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov  2 13:16:48 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<1vEZzZdC/J9ChJl2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.175
country_id: 6252001
description:
Nov  2 13:17:20 host2 sshd[3139684]: Invalid user cloudtourssrilan_travel from 124.198.132.175 port 56901


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.109
country_id: 6252001
description:
Nov  2 13:17:48 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.109, lip=66.85.158.92, TLS, session=<NLat0JdCVuHG6xht>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.105.153
country_id: 1880251
description:
Nov  2 13:18:08 host2 sshd[3140466]: Disconnected from invalid user ftpuser 165.22.105.153 port 60472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.94.253
country_id: 2921044
description:
Nov  2 13:18:59 host2 sshd[3141159]: Disconnected from invalid user docker 64.226.94.253 port 49866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.105.153
country_id: 1880251
description:
Nov  2 13:19:45 host2 sshd[3141860]: Disconnected from invalid user msger 165.22.105.153 port 54604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.94.253
country_id: 2921044
description:
Nov  2 13:20:37 host2 sshd[3142861]: Disconnected from invalid user hsayed 64.226.94.253 port 38632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.54
country_id: 3057568
description:
2025-11-02 13:20:44 dovecot_login authenticator failed for (ADMIN) [149.102.232.54]:26121: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov  2 13:21:54 host2 sshd[3144329]: Disconnected from invalid user diana 20.102.116.25 port 44950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.105.153
country_id: 1880251
description:
Nov  2 13:21:15 host2 sshd[3143647]: Disconnected from invalid user inssserver 165.22.105.153 port 52318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-11-02 13:23:05 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (cateal) [93.145.118.40]:53788: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.226.94.253
country_id: 2921044
description:
Nov  2 13:22:52 host2 sshd[3145258]: Disconnected from invalid user daro 64.226.94.253 port 45782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.29
country_id: 2542007
description:
Nov  2 13:23:38 host2 sshd[3145991]: Disconnected from invalid user docker 81.192.46.29 port 39874 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.68
country_id: 2635167
description:
Nov  2 13:28:01 host2 dovecot[3096982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.68, lip=66.85.158.92, TLS, session=<QhAw9ZdC0Y2594lE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.201
country_id: 2635167
description:
Nov  2 13:28:02 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.201, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DCxC9ZdCb45X7LDJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.94.253
country_id: 2921044
description:
Nov  2 13:28:22 host2 sshd[3150962]: Disconnected from invalid user ubo 64.226.94.253 port 53924 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  2 13:28:35 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mnQ995dCDYVX7LDX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.160
country_id: 3469034
description:
Nov  2 13:28:50 host2 sshd[3151326]: Disconnected from invalid user postgres 189.47.10.160 port 57896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.29
country_id: 2542007
description:
Nov  2 13:29:33 host2 sshd[3152057]: Disconnected from invalid user ftpuser1 81.192.46.29 port 46170 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.189
country_id: 2635167
description:
Nov  2 13:29:42 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.189, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<8jg0+5dCa8K594m9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.213
country_id: 2635167
description:
Nov  2 13:29:09 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.213, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<ZQU5+ZdC26y594nV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.195
country_id: 2635167
description:
Nov  2 13:30:15 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.195, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<AJAv/ZdCo4C594nD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.207
country_id: 2635167
description:
Nov  2 13:30:48 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tewo/5dCyb5X7LDP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Nov  2 13:31:21 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.186, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UBEmAZhCq8BX7LC6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.185
country_id: 2635167
description:
Nov  2 13:31:55 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.185, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<qoghA5hC255X7LC5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Nov  2 13:32:28 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.186, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<vNAaBZhCW5RX7LC6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.209
country_id: 2635167
description:
Nov  2 13:33:01 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.209, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Y2EWB5hCCbRX7LDR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.160
country_id: 3469034
description:
Nov  2 13:39:54 host2 sshd[3162480]: Disconnected from invalid user gd 189.47.10.160 port 51328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-11-02 13:40:17 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (parchiess) [78.66.119.139]:45132: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.160
country_id: 3469034
description:
Nov  2 13:42:37 host2 sshd[3165344]: Disconnected from invalid user liping 189.47.10.160 port 60382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.4
country_id: 174982
description:
2025-11-02 13:45:22 dovecot_login authenticator failed for (ADMIN) [185.253.160.4]:45724: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.123
country_id: 6252001
description:
Nov  2 13:54:44 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.123, lip=66.85.158.92, TLS: Connection closed, session=<7iy4VJhC5uHHLZp7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 13:54:34 host2 sshd[3178275]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.143
country_id: 1733045
description:
2025-11-02 13:56:23 dovecot_login authenticator failed for ([49.124.152.143]) [49.124.152.143]:40572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-02 13:56:30 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:43926: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2025-11-02 13:57:02 dovecot_login authenticator failed for ([49.124.151.55]) [49.124.151.55]:56440: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.5
country_id: 1733045
description:
2025-11-02 13:56:06 dovecot_login authenticator failed for ([49.124.148.5]) [49.124.148.5]:41772: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.160
country_id: 3469034
description:
Nov  2 13:56:12 host2 sshd[3179946]: Disconnected from invalid user elk 189.47.10.160 port 37214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-02 14:02:25 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:54945: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-02 14:02:34 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:56186: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-02 14:03:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61089: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-11-02 14:05:12 dovecot_plain authenticator failed for (extid) [185.214.169.10]:56741: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.74
country_id: 2921044
description:
2025-11-02 14:05:57 dovecot_login authenticator failed for (ADMIN) [191.101.157.74]:44050: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  2 14:07:05 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<fWnkgJhCe//CpRCl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.255.193.50
country_id: 1522867
description:
Nov  2 14:09:07 host2 sshd[3193456]: Disconnected from invalid user oper 87.255.193.50 port 48808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-11-02 14:09:55 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (speral) [71.230.228.16]:46860: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 14:14:45 host2 sshd[3199519]: Disconnected from invalid user pritchard 2.57.121.112 port 61349 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.177.125.233
country_id: 1210997
description:
Nov  2 14:15:35 host2 sshd[3200493]: Disconnected from invalid user dmitry 103.177.125.233 port 60378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.255.193.50
country_id: 1522867
description:
Nov  2 14:15:38 host2 sshd[3200557]: Disconnected from invalid user testftp 87.255.193.50 port 56380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.222
country_id: 6252001
description:
Nov  2 14:18:01 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.222, lip=66.85.158.92, TLS, session=<n0f8p5hCNvDG6xje>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.177.125.233
country_id: 1210997
description:
Nov  2 14:17:17 host2 sshd[3202299]: Disconnected from invalid user bull 103.177.125.233 port 51968 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.177.125.233
country_id: 1210997
description:
Nov  2 14:18:52 host2 sshd[3203855]: Disconnected from invalid user spark 103.177.125.233 port 39976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.177.125.233
country_id: 1210997
description:
Nov  2 14:20:17 host2 sshd[3205336]: Disconnected from invalid user ftpuser 103.177.125.233 port 50564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.177.125.233
country_id: 1210997
description:
Nov  2 14:21:46 host2 sshd[3207056]: Disconnected from invalid user turbo 103.177.125.233 port 35002 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 14:22:40 host2 sshd[3207902]: Disconnected from invalid user pritchard 2.57.121.112 port 61836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov  2 14:23:15 host2 sshd[3208480]: Disconnected from invalid user hoffmann 130.107.240.11 port 43324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-11-02 14:23:30 dovecot_plain authenticator failed for (ophly) [185.214.169.10]:52140: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov  2 14:24:58 host2 sshd[3210140]: Disconnected from invalid user si 130.107.240.11 port 46050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.85
country_id: 3865483
description:
2025-11-02 14:25:37 dovecot_login authenticator failed for (ADMIN) [146.70.38.85]:44088: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.107.240.11
country_id: 6251999
description:
Nov  2 14:26:37 host2 sshd[3211836]: Disconnected from invalid user tomcat2 130.107.240.11 port 60292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.47
country_id: 1733045
description:
2025-11-02 14:28:21 dovecot_login authenticator failed for ([49.124.149.47]) [49.124.149.47]:49658: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.192.250
country_id: 1522867
description:
2025-11-02 14:28:26 dovecot_login authenticator failed for (2-74-192-250.kcell.kz) [2.74.192.250]:40723: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-02 14:28:41 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:45111: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.103
country_id: 1733045
description:
2025-11-02 14:29:04 dovecot_login authenticator failed for ([49.124.133.103]) [49.124.133.103]:59168: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 14:32:13 host2 sshd[3217575]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-11-02 14:37:09 dovecot_plain authenticator failed for (gualints) [102.53.15.180]:40530: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.146
country_id: 1269750
description:
2025-11-02 14:38:08 dovecot_login authenticator failed for ([125.16.255.129]) [125.20.246.146]:50706: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.20
country_id: 1733045
description:
2025-11-02 14:38:57 dovecot_login authenticator failed for ([49.124.149.20]) [49.124.149.20]:56038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-02 14:38:21 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:33126: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-11-02 14:38:21 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:50292: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.0.148.211
country_id: 6252001
description:
2025-11-02 14:38:35 dovecot_login authenticator failed for (198-0-148-211-static.hfc.comcastbusiness.net) [198.0.148.211]:44886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-11-02 14:38:37 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:55717: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-02 14:41:54 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (yanness) [67.172.54.29]:35660: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-02 14:41:58 dovecot_plain authenticator failed for (rerlisack) [65.20.233.110]:55479: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.125.90
country_id: 6252001
description:
2025-11-02 14:47:58 dovecot_login authenticator failed for (ADMIN) [151.241.125.90]:16739: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.101.196.103
country_id: 6252001
description:
2025-11-02 14:48:56 dovecot_plain authenticator failed for ([172.23.0.4]) [199.101.196.103]:48726: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-02 14:49:27 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:38824: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-02 14:49:35 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:50899: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.88.31
country_id: 2750405
description:
2025-11-02 14:51:26 dovecot_plain authenticator failed for ([196.251.88.31]) [196.251.88.31]:59297: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.88.31
country_id: 2750405
description:
2025-11-02 14:52:16 dovecot_plain authenticator failed for ([196.251.88.31]) [196.251.88.31]:63610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.88.31
country_id: 2750405
description:
[2025-11-02 14:52:39 +0530] info [cpaneld] 196.251.88.31 - lezzarotech "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.89
country_id: 6252001
description:
Nov  2 14:53:23 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.155.89, lip=66.85.158.92, TLS: Connection closed, session=<Vbl5JplCMrHHLZtZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-02 14:56:23 dovecot_plain authenticator failed for 81-234-121-57-no600.tbcn.telia.com (kinnuade) [81.234.121.57]:46530: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.205
country_id: 1733045
description:
2025-11-02 14:57:20 dovecot_login authenticator failed for ([49.124.149.205]) [49.124.149.205]:60686: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.69.224
country_id: 294640
description:
2025-11-02 14:57:30 dovecot_login authenticator failed for (2-55-69-224.orange.net.il) [2.55.69.224]:53507: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-02 14:57:39 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:60622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-11-02 14:57:54 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:41764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 14:58:01 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6FEMN5lCIt4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 14:59:14 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<V2xmO5lCqqEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-02 15:00:32 dovecot_plain authenticator failed for (lateled) [94.201.22.158]:34312: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.4
country_id: 2635167
description:
Nov  2 15:00:42 host2 dovecot[3096982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.4, lip=66.85.158.91, TLS, session=<QpeoQJlCvY9X7LAE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.17
country_id: 2635167
description:
Nov  2 15:00:44 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.17, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XujBQJlCZY+594kR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:00:54 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<S71fQZlCuNADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.28
country_id: 2635167
description:
Nov  2 15:01:17 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.28, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gDC9QplCEepX7LAc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:01:27 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ej1TQ5lCqooDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.36
country_id: 2635167
description:
Nov  2 15:01:50 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.36, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Lkq5RJlCA+NX7LAk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.29
country_id: 2635167
description:
Nov  2 15:02:23 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.29, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Cre0RplChcq594kd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:02:39 host2 dovecot[3096982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<DailR5lCpoIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.31
country_id: 2635167
description:
Nov  2 15:02:57 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.31, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<SwewSJlC6b6594kf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.193
country_id: 6252001
description:
Nov  2 15:03:00 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.193, lip=66.85.158.91, session=<I1vhSJlCxO7G6xjB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.26
country_id: 2635167
description:
Nov  2 15:03:30 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5mqpSplC6YxX7LAa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:03:38 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NkQpS5lCSKYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.25
country_id: 2635167
description:
Nov  2 15:04:03 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.25, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<UcymTJlCeeW594kZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.2
country_id: 2635167
description:
Nov  2 15:04:36 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.2, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Vg2iTplCM6RX7LAC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.36
country_id: 2635167
description:
Nov  2 15:05:10 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<6X2bUJlC36+594kk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:04:29 host2 dovecot[3096982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<YAA2TplCgowDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.11
country_id: 2635167
description:
Nov  2 15:05:43 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.11, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<G8qWUplCEe2594kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:06:21 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<Xa/gVJlC0J8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 15:08:12 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<J452W5lCzu0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.177.170.161
country_id: 6252001
description:
2025-11-02 15:12:33 dovecot_plain authenticator failed for (gononer) [76.177.170.161]:33371: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-02 15:14:24 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (trysitely) [68.60.77.128]:57564: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Nov  2 15:16:54 host2 sshd[3272470]: Disconnected from invalid user mssql 172.214.209.153 port 58118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-02 15:18:27 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:57408: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-02 15:18:37 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:55642: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-11-02 15:18:49 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:56203: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.163.49
country_id: 3374766
description:
2025-11-02 15:19:00 dovecot_login authenticator failed for ([102.209.163.49]) [102.209.163.49]:44126: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.71
country_id: 6252001
description:
Nov  2 15:20:21 host2 pure-ftpd[3275998]: (?@199.45.155.71) [INFO] New connection from 199.45.155.71


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.214.209.153
country_id: 6252001
description:
Nov  2 15:22:10 host2 sshd[3277604]: Disconnected from invalid user operator1 172.214.209.153 port 47042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Nov  2 15:23:51 host2 sshd[3279176]: Disconnected from invalid user user1 172.214.209.153 port 43244 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  2 15:25:00 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</gKNl5lClQnCpRCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 93.174.95.106
country_id: 2750405
description:
Nov  2 15:25:11 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=93.174.95.106, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<HpszmJlCUIhdrl9q>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 15:27:31 host2 sshd[3282871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  2 15:33:31 host2 sshd[3288993]: Disconnected from invalid user test 179.40.112.10 port 50480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.27
country_id: 146669
description:
2025-11-02 15:36:19 dovecot_login authenticator failed for (ADMIN) [185.253.162.27]:33262: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  2 15:37:48 host2 sshd[3293380]: Disconnected from invalid user tre 62.60.131.157 port 32259 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.100.67
country_id: 1733045
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 113.211.100.67 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.104.193.207
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.104.193.207 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.238.42.111
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 88.238.42.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.119.217.190
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 157.119.217.190 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.170.112
country_id: 290557
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 5.107.170.112 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.234.244.132
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 88.234.244.132 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.40.48
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.43.40.48 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.109.92.113
country_id: 1210997
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.109.92.113 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.61.178.36
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.61.178.36 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.97.244
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 182.10.97.244 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.10.128
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.228.10.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.135.47.0
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 70.135.47.0 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.218.62.49
country_id: 2661886
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 77.218.62.49 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.142.154
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 35.148.142.154 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.191.22.205
country_id: 690791
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 188.191.22.205 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.217.161.225
country_id: 390903
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 31.217.161.225 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.76.6
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.207.76.6 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.15.42.35
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.15.42.35 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.252.155.163
country_id: 2186224
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 27.252.155.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.104.207.142
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 85.104.207.142 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.149.221.149
country_id: 2635167
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 78.149.221.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.39.123.57
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.39.123.57 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.166.235
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.22.166.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.44.60.110
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 50.44.60.110 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.116.93.135
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 177.116.93.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.164.145.131
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 216.164.145.131 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.22.13.213
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 184.22.13.213 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.241.178.94
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 88.241.178.94 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.10.144
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.203.10.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.240.178
country_id: 1733045
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 27.125.240.178 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.38.249
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 160.202.38.249 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.108.183
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.59.108.183 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.26.24
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.43.26.24 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.234.79.5
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 188.234.79.5 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.206.32.151
country_id: 690791
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 91.206.32.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.92.186.159
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 89.92.186.159 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.92.182.230
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.92.182.230 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.78.105.249
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 201.78.105.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.243.83.116
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 43.243.83.116 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.224.140.30
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 141.224.140.30 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.91.86.87
country_id: 3437598
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 181.91.86.87 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.90.58.241
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 2.90.58.241 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.212.226
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 188.53.212.226 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.107.68.218
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 85.107.68.218 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.110.142.70
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 174.110.142.70 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.192.34
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.36.192.34 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.146.113.202
country_id: 587116
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.146.113.202 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.134.45.243
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 177.134.45.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.175.133
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.36.175.133 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.205.133
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.93.205.133 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.146.192.113
country_id: 2623032
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 94.146.192.113 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.36.146.82
country_id: 286963
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 5.36.146.82 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.87.153.136
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 115.87.153.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.164.172
country_id: 3996063
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 187.189.164.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.11.118.87
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.11.118.87 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.18.61.96
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.18.61.96 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.100.69.187
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 189.100.69.187 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.197.48.198
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 82.197.48.198 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.125.101
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 172.58.125.101 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.252.174.219
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.252.174.219 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.243.31.124
country_id: 6290252
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 77.243.31.124 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.92.19.123
country_id: 2264397
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 95.92.19.123 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.135.182.67
country_id: 690791
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.135.182.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.206.143.225
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.206.143.225 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.131.209.95
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 27.131.209.95 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.210.250.33
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 174.210.250.33 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.201.68.138
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 69.201.68.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.218.168.82
country_id: 1819730
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 203.218.168.82 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.179.182.183
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.179.182.183 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.147.173
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.157.147.173 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.223.109.89
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.223.109.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.215.60.145
country_id: 690791
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.215.60.145 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.249.58.23
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.249.58.23 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.219.65.136
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 106.219.65.136 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.210.230.78
country_id: 99237
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 178.210.230.78 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.51.180
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.36.51.180 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.95.81.37
country_id: 953987
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 197.95.81.37 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.9.252.45
country_id: 2635167
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.9.252.45 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.2.234.38
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 103.2.234.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.184.64.4
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 65.184.64.4 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.222.27.241
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.222.27.241 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.246.39.254
country_id: 1821275
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 60.246.39.254 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.45.75.17
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.45.75.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.145.236.77
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 31.145.236.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.68.236.220
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.68.236.220 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.178.53.230
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.178.53.230 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.120.218.34
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 93.120.218.34 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.29.243.242
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 96.29.243.242 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.1.77.249
country_id: 1562822
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 42.1.77.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.147.102.69
country_id: 99237
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.147.102.69 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.156.91.38
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 97.156.91.38 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.100.16.36
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.100.16.36 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-02 15:39:40 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:52832: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-02 15:39:47 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (postol) [24.127.53.61]:37188: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.14
country_id: 1269750
description:
2025-11-02 15:39:13 dovecot_login authenticator failed for ([128.185.217.24]) [128.185.218.14]:48908: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.130
country_id: 1269750
description:
2025-11-02 15:39:54 dovecot_login authenticator failed for ([182.95.22.104]) [125.23.155.130]:45714: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Nov  2 15:41:14 host2 sshd[3297298]: Disconnected from invalid user frappe 52.224.71.115 port 56070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-02 15:42:18 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:58466: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-11-02 15:45:05 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (ophies) [73.0.235.30]:33208: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Nov  2 15:45:51 host2 dovecot[3096982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<2XEj4plCKJy58uIR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov  2 15:46:40 host2 sshd[3305230]: Disconnected from invalid user weber 103.165.156.59 port 40760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-11-02 15:48:37 dovecot_login authenticator failed for ([103.67.152.201]) [103.67.152.201]:44630: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-02 15:48:49 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:55984: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-02 15:48:55 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:41247: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-02 15:48:26 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:5951: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-02 15:50:24 dovecot_plain authenticator failed for (prefus) [65.20.250.63]:44259: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.130
country_id: 1269750
description:
2025-11-02 15:51:37 dovecot_login authenticator failed for ([182.95.22.104]) [125.23.155.130]:59186: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-02 15:51:52 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41323: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Nov  2 15:51:52 host2 dovecot[3096982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<7KGo95lC8L658uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-02 15:52:14 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:52095: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-02 15:52:16 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:38894: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-02 15:52:29 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:53146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.221.207
country_id: 3374766
description:
2025-11-02 15:52:37 dovecot_login authenticator failed for ([41.215.221.207]) [41.215.221.207]:46235: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-11-02 15:52:43 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:52501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.165.156.59
country_id: 1643084
description:
Nov  2 15:56:16 host2 sshd[3315501]: Disconnected from invalid user hardy 103.165.156.59 port 38372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-02 15:57:11 dovecot_plain authenticator failed for (supervards) [24.104.225.201]:53578: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov  2 15:57:52 host2 sshd[3317009]: Disconnected from invalid user bck 103.165.156.59 port 43602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov  2 15:59:31 host2 sshd[3318704]: Disconnected from invalid user ndutumo 103.165.156.59 port 50894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.147
country_id: 102358
description:
2025-11-02 16:03:33 dovecot_login authenticator failed for (ADMIN) [95.181.235.147]:16839: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 16:05:10 host2 sshd[3325719]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-02 16:05:30 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41873: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
country_id: 290557
description:
2025-11-02 16:05:39 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:42290: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov  2 16:20:17 host2 sshd[3341627]: Disconnected from invalid user frappe 34.58.124.191 port 40178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.216
country_id: 3175395
description:
2025-11-02 16:21:55 dovecot_login authenticator failed for (ADMIN) [156.146.41.216]:48652: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-02 16:23:25 dovecot_plain authenticator failed for (chers) [65.20.204.193]:50661: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-02 16:23:28 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (reous) [73.224.171.101]:37820: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.94.63
country_id: 1269750
description:
Nov  2 16:28:20 host2 sshd[3350094]: Invalid user cloudtourssrilan_travel from 139.59.94.63 port 45220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-02 16:32:36 dovecot_plain authenticator failed for (senteepial) [65.20.205.197]:39772: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.39.9.137
country_id: 1168579
description:
Nov  2 16:33:55 host2 sshd[3355812]: Disconnected from invalid user server 110.39.9.137 port 44056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.37.187
country_id: 3017382
description:
Nov  2 16:34:44 host2 sshd[3356558]: Disconnected from invalid user guest 51.178.37.187 port 40488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.229
country_id: 130758
description:
Nov  2 16:35:47 host2 sshd[3357771]: Disconnected from invalid user frappe 85.208.253.229 port 24416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Nov  2 16:37:07 host2 sshd[3359203]: Disconnected from invalid user desktop 110.39.9.137 port 55642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.37.187
country_id: 3017382
description:
Nov  2 16:39:25 host2 sshd[3361656]: Disconnected from invalid user ic 51.178.37.187 port 50872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.85
country_id: 2921044
description:
2025-11-02 16:40:57 dovecot_login authenticator failed for (ADMIN) [191.101.157.85]:29134: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.192
country_id: 2635167
description:
Nov  2 16:40:58 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.192, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<fllCp5pC3ca594nA>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.88
country_id: 2635167
description:
Nov  2 16:40:57 host2 dovecot[3096982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.88, lip=66.85.158.91, TLS, session=<JOMtp5pCceO594lY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Nov  2 16:40:10 host2 sshd[3362529]: Disconnected from invalid user logify 110.39.9.137 port 38966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.37.187
country_id: 3017382
description:
Nov  2 16:40:31 host2 sshd[3362932]: Disconnected from invalid user devops 51.178.37.187 port 55138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.53.154
country_id: 1643084
description:
Nov  2 16:40:51 host2 sshd[3363199]: Disconnected from invalid user noc 203.190.53.154 port 43198 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.183
country_id: 2635167
description:
Nov  2 16:42:05 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.183, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Aww5q5pCU6pX7LC3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.37.187
country_id: 3017382
description:
Nov  2 16:42:09 host2 sshd[3364537]: Disconnected from invalid user scott 51.178.37.187 port 55582 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.191
country_id: 2635167
description:
Nov  2 16:41:32 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.191, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<eqU9qZpCw7m594m/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  2 16:42:38 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<gEA0rZpCAexX7LDX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.201
country_id: 2635167
description:
Nov  2 16:43:11 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.201, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Iukvr5pCIZtX7LDJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.214
country_id: 2635167
description:
Nov  2 16:43:44 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.214, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hkYpsZpCF6i594nW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov  2 16:43:55 host2 sshd[3366487]: Disconnected from invalid user scott 159.223.8.81 port 53704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.211
country_id: 2635167
description:
Nov  2 16:44:19 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.211, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<9LU2s5pCGatX7LDT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Nov  2 16:44:27 host2 sshd[3367040]: Disconnected from invalid user webadmin 197.13.24.157 port 38966 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.214
country_id: 2635167
description:
Nov  2 16:44:52 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.214, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<C8YxtZpCX8q594nW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Nov  2 16:45:48 host2 sshd[3369013]: Disconnected from invalid user unilab 197.13.24.157 port 39378 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.205
country_id: 2635167
description:
Nov  2 16:45:58 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<3ncmuZpCGcG594nN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.188
country_id: 2635167
description:
Nov  2 16:45:25 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.188, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<QR8rt5pCo8K594m8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-02 16:46:39 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:58171: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.50.60.15
country_id: 3865483
description:
2025-11-02 16:47:00 dovecot_login authenticator failed for ([38.50.60.15]) [38.50.60.15]:55804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2025-11-02 16:47:04 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [129.0.111.246]:54713: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.150
country_id: 1733045
description:
2025-11-02 16:46:37 dovecot_login authenticator failed for ([49.124.152.150]) [49.124.152.150]:45016: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Nov  2 16:46:48 host2 sshd[3370020]: Disconnected from invalid user guilherme 159.223.8.81 port 55364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.53.154
country_id: 1643084
description:
Nov  2 16:48:22 host2 sshd[3371602]: Disconnected from invalid user scott 203.190.53.154 port 43204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Nov  2 16:48:30 host2 sshd[3371698]: Disconnected from invalid user mplan 197.13.24.157 port 54434 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 16:50:00 host2 sshd[3373257]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2025-11-02 16:49:44 dovecot_login authenticator failed for syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:61384: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-02 16:50:00 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:38308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 17:00:32 host2 sshd[3384939]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-02 17:01:31 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (stilitoid) [67.173.58.47]:49282: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 17:02:18 host2 sshd[3386865]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 17:06:18 host2 sshd[3391459]: Disconnected from invalid user guest 2.57.121.112 port 61938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-02 17:08:49 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:44214: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-11-02 17:09:11 dovecot_plain authenticator failed for (comern) [96.85.104.2]:42152: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.33.23
country_id: 6252001
description:
Nov  2 17:13:30 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.163.33.23, lip=66.85.158.91, session=<TiWeG5tCiroUoyEX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 17:14:11 host2 sshd[3400159]: Disconnected from invalid user guest 2.57.121.112 port 62659 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-02 17:18:13 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:32978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.21
country_id: 1733045
description:
2025-11-02 17:17:57 dovecot_login authenticator failed for ([49.124.149.21]) [49.124.149.21]:33294: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.30
country_id: 1168579
description:
2025-11-02 17:18:03 dovecot_login authenticator failed for (30.92.zcomnetworks.com.pk) [103.148.92.30]:38499: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-02 17:18:47 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:60550: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-02 17:26:19 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (bitess) [73.213.236.66]:35314: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-02 17:28:03 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:48378: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-02 17:28:11 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:40376: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-11-02 17:28:26 dovecot_login authenticator failed for ([203.124.44.231]) [203.124.44.231]:51721: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-02 17:28:26 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:58996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.4
country_id: 3042058
description:
2025-11-02 17:31:06 dovecot_login authenticator failed for (ADMIN) [91.90.122.4]:46352: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.214.61.216
country_id: 2245662
description:
Nov  2 17:31:29 host2 sshd[3418544]: Disconnected from invalid user nick 41.214.61.216 port 50462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-02 17:32:08 dovecot_plain authenticator failed for (reneetfush) [154.146.240.123]:33294: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.214.61.216
country_id: 2245662
description:
Nov  2 17:36:56 host2 sshd[3424389]: Disconnected from invalid user harrison 41.214.61.216 port 55291 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 17:38:17 host2 sshd[3425856]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-02 17:41:52 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (unposal) [73.197.194.98]:57666: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-02 17:43:12 dovecot_plain authenticator failed for (pectry) [84.238.92.245]:58003: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-11-02 17:44:39 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (hized) [72.241.202.216]:41833: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.143.127
country_id: 2921044
description:
Nov  2 17:45:02 host2 dovecot[3096982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.92.143.127, lip=66.85.158.92, session=<TwtXjJtCatmkXI9/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.214.61.216
country_id: 2245662
description:
Nov  2 17:45:07 host2 sshd[3433782]: Disconnected from invalid user rundeck 41.214.61.216 port 48307 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-02 17:45:26 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (uncaratora) [24.127.53.61]:44978: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-02 17:46:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59699: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
country_id: 3865483
description:
2025-11-02 17:46:51 dovecot_login authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:59146: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-02 17:47:01 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:11697: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-11-02 17:47:28 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:59884: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-02 17:47:24 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:43555: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.36.85
country_id: 6251999
description:
2025-11-02 17:53:26 dovecot_login authenticator failed for (ADMIN) [191.96.36.85]:28174: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov  2 17:54:23 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<M0TMrZtC2f8t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.195.206
country_id: 6252001
description:
Nov  2 17:54:35 host2 sshd[3444804]: Invalid user secondcoffeeinternational from 50.6.195.206 port 55212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-02 17:56:54 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:33228: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-02 17:57:24 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:51347: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-11-02 18:07:27 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:34526: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-11-02 18:07:34 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:34620: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov  2 18:07:40 host2 dovecot[3096982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.92, session=<fh1K3ZtCjN6UcdL+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-11-02 18:07:50 dovecot_login authenticator failed for ([61.0.236.99]) [182.72.143.2]:39308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-02 18:07:55 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:34652: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.6
country_id: 3042225
description:
2025-11-02 18:18:04 dovecot_login authenticator failed for (ADMIN) [91.90.124.6]:32790: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 18:20:00 host2 sshd[3474961]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-11-02 18:19:38 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:34608: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov  2 18:19:49 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RkfBCJxCAf/CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-11-02 18:20:21 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:40410: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.139.140.231
country_id: 1168579
description:
2025-11-02 18:20:46 dovecot_login authenticator failed for ([103.139.140.231]) [103.139.140.231]:52898: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.19.10.129
country_id: 3865483
description:
Nov  2 18:21:38 host2 sshd[3477017]: Disconnected from invalid user partner 190.19.10.129 port 54612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-11-02 18:21:55 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:51362: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-02 18:21:37 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:56074: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.237.229
country_id: 6251999
description:
Nov  2 18:25:38 host2 dovecot[3096982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.237.229, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<t4qVHZxCss+lFu3l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-11-02 18:26:14 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (micram) [71.235.225.181]:55104: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.233.119
country_id: 2661886
description:
2025-11-02 18:26:39 dovecot_plain authenticator failed for c188-150-233-119.bredband.tele2.se (dehorous) [188.150.233.119]:50666: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.70.26
country_id: 248816
description:
2025-11-02 18:27:57 dovecot_login authenticator failed for (212.35.70.26.ua.batelco.jo) [212.35.70.26]:44503: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-11-02 18:28:06 dovecot_login authenticator failed for ([185.246.255.183]) [185.246.255.183]:34354: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-02 18:29:05 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:50462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-02 18:29:05 dovecot_login authenticator failed for ([182.95.22.224]) [27.123.104.158]:54146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.19.10.129
country_id: 3865483
description:
Nov  2 18:29:40 host2 sshd[3485922]: Disconnected from invalid user peters 190.19.10.129 port 48012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.72.204
country_id: 6252001
description:
Nov  2 18:29:40 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.72.204, lip=66.85.158.92, session=<koYCLJxC1IMUUEjM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 18:30:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (graft) [87.103.126.54]:65283: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 18:32:11 host2 sshd[3489049]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 18:33:51 host2 sshd[3490880]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Nov  2 18:33:39 host2 sshd[3490447]: Disconnected from invalid user sh 181.46.131.55 port 59576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.199.225.42
country_id: 6252001
description:
Nov  2 18:35:00 host2 sshd[3492103]: Disconnected from invalid user td 134.199.225.42 port 56768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.121
country_id: 357994
description:
2025-11-02 18:35:45 dovecot_login authenticator failed for (ADMIN) [188.214.122.121]:53247: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.225.42
country_id: 6252001
description:
Nov  2 18:36:32 host2 sshd[3493979]: Disconnected from invalid user flectra 134.199.225.42 port 40010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-11-02 18:37:08 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:46898: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  2 18:37:45 host2 dovecot[3096982]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<fvjeSJxC5//CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-02 18:37:59 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:50950: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-11-02 18:37:24 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:50594: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-02 18:37:26 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:37302: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.200.86
country_id: 1269750
description:
2025-11-02 18:41:04 dovecot_login authenticator failed for ([182.95.84.188]) [125.22.200.86]:44304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-02 18:40:38 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:52706: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-02 18:40:39 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:39532: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-02 18:40:42 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:46893: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-02 18:40:45 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:28307: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.19.10.129
country_id: 3865483
description:
Nov  2 18:41:39 host2 sshd[3500535]: Disconnected from invalid user siste 190.19.10.129 port 33720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-02 18:41:16 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:49484: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.189
country_id: 1733045
description:
2025-11-02 18:41:17 dovecot_login authenticator failed for ([49.124.148.189]) [49.124.148.189]:47148: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.46.131.55
country_id: 3865483
description:
Nov  2 18:45:41 host2 sshd[3505868]: Disconnected from invalid user etty 181.46.131.55 port 48538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 18:50:09 host2 sshd[3512191]: Disconnected from invalid user user 2.57.121.25 port 31535 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-11-02 18:51:45 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:36414: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-11-02 18:52:02 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (innung) [68.38.201.238]:60582: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-02 18:52:14 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:36339: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-02 18:53:26 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (patings) [81.226.88.121]:38042: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-11-02 18:55:35 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:41916: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov  2 18:56:05 host2 sshd[3519035]: Disconnected from invalid user wwj 155.93.89.195 port 33274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-11-02 18:56:16 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:56132: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov  2 18:58:42 host2 sshd[3521487]: Disconnected from invalid user sandeep 155.93.89.195 port 54014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.93.89.195
country_id: 2328926
description:
Nov  2 19:00:26 host2 sshd[3523615]: Disconnected from invalid user cjd 155.93.89.195 port 51000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.14
country_id: 3996063
description:
2025-11-02 19:00:31 dovecot_login authenticator failed for (ADMIN) [77.81.142.14]:19802: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov  2 19:02:06 host2 sshd[3525265]: Disconnected from invalid user newuser 155.93.89.195 port 50340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov  2 19:08:50 host2 sshd[3533708]: Disconnected from invalid user farhad 155.93.89.195 port 60610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-02 19:10:51 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:41147: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-02 19:10:57 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:52308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 19:11:53 host2 sshd[3536905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.76.116.132
country_id: 6252001
description:
Nov  2 19:15:27 host2 pure-ftpd[3541094]: (?@40.76.116.132) [INFO] New connection from 40.76.116.132


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov  2 19:18:39 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, session=<WGki25xCLNCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.19.10.129
country_id: 3865483
description:
Nov  2 19:18:59 host2 sshd[3545066]: Disconnected from invalid user saggio 190.19.10.129 port 60084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-02 19:20:02 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:33746: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-02 19:20:10 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:53810: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.25
country_id: 2661886
description:
2025-11-02 19:22:46 dovecot_login authenticator failed for (ADMIN) [46.246.8.25]:62128: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov  2 19:23:48 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.92, session=<nmCa7ZxCNpCUcd0c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-02 19:29:24 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:54426: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-02 19:30:02 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:47014: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov  2 19:32:11 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=67.213.82.18, lip=66.85.158.91, session=<W0iJC51CkNZD1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:32:27 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<c0aKDJ1CkoEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-02 19:34:17 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:48646: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-11-02 19:34:22 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:59079: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-02 19:34:38 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:56394: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-11-02 19:34:57 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:35429: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-02 19:36:01 dovecot_plain authenticator failed for (ulless) [23.30.11.253]:58669: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:35:31 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<E+h1F51CALIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:37:09 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<k1JUHZ1C2t4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:37:33 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<TEHHHp1CBrIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-02 19:39:06 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:52197: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-11-02 19:38:59 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:39962: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:39:31 host2 dovecot[3500256]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<76HNJZ1CMMYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:39:22 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<HFQ7JZ1C+MUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Nov  2 19:41:21 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=167.94.146.61, lip=66.85.158.91, TLS: Connection closed, session=<GrNaLJ1Cyr6nXpI9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.39.180
country_id: 6252001
description:
Nov  2 19:41:59 host2 sshd[3570364]: Disconnected from invalid user badajoz 107.175.39.180 port 58860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:42:10 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<8U9CL51CVNIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  2 19:42:34 host2 dovecot[3500256]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<GXW1MJ1CuocDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-02 19:43:15 dovecot_login authenticator failed for ([122.187.229.36]) [122.187.229.36]:56327: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-02 19:43:23 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:41292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov  2 19:45:14 host2 sshd[3574066]: Disconnected from invalid user celeste 107.175.39.180 port 35060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-02 19:46:03 dovecot_plain authenticator failed for (pater) [65.20.250.63]:54888: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-11-02 19:46:07 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (unati) [68.38.201.238]:42782: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.13.114
country_id: 6252001
description:
Nov  2 19:46:11 host2 dovecot[3500256]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.13.114, lip=66.85.158.91, session=<1DudPZ1CoKkUow1y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov  2 19:48:36 host2 sshd[3577663]: Disconnected from invalid user ctf 107.175.39.180 port 37164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.91
country_id: 3175395
description:
2025-11-02 19:50:31 dovecot_login authenticator failed for (ADMIN) [156.146.41.91]:60188: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 19:59:32 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:10078: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-02 19:59:25 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:48499: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-11-02 20:03:13 dovecot_login authenticator failed for ([203.124.44.231]) [203.124.44.231]:56640: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-11-02 20:02:40 dovecot_login authenticator failed for ([208.69.161.214]) [208.69.161.214]:49897: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-02 20:04:04 dovecot_plain authenticator failed for (fureaiste) [65.20.186.177]:50650: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-11-02 20:04:53 dovecot_login authenticator failed for ([61.0.236.99]) [182.72.143.2]:53710: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-02 20:05:02 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:45298: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.99.175
country_id: 2661886
description:
2025-11-02 20:05:05 dovecot_login authenticator failed for 193.180.99.175.bredband.obe.net [193.180.99.175]:52632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-11-02 20:04:39 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (calitilluk) [73.53.254.168]:38382: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-02 20:05:31 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:46844: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-02 20:05:31 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (suburecier) [85.225.19.144]:52331: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 20:07:57 host2 sshd[3598152]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-02 20:08:24 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (conic) [73.197.194.98]:42666: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.122.170
country_id: 2661886
description:
2025-11-02 20:13:30 dovecot_login authenticator failed for h-155-4-122-170.a259.priv.bahnhof.se [155.4.122.170]:54962: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.121.92
country_id: 6252001
description:
Nov  2 20:13:46 host2 dovecot[3500256]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.121.92, lip=66.85.158.92, session=<7plEoJ1CkJsNWXlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2025-11-02 20:13:53 dovecot_login authenticator failed for ([196.0.41.134]) [196.0.41.134]:44086: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-02 20:14:37 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:46298: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-02 20:14:52 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:37836: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-11-02 20:15:33 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:59806: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-02 20:15:44 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:60529: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-02 20:17:37 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (holitess) [73.196.144.25]:46334: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-11-02 20:19:11 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (eryomat) [98.193.112.85]:45398: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-02 20:28:38 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:42014: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.153.115.3
country_id: 2921044
description:
2025-11-02 20:33:22 dovecot_login authenticator failed for ([148.153.115.3]) [148.153.115.3]:33916: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 290557
description:
2025-11-02 20:34:00 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:59358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-02 20:34:03 dovecot_login authenticator failed for (abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:40956: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2025-11-02 20:34:24 dovecot_login authenticator failed for ([49.124.148.192]) [49.124.148.192]:35088: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  2 20:35:25 host2 dovecot[3500256]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<le+y7Z1CQJNChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.36
country_id: 2264397
description:
2025-11-02 20:35:43 dovecot_login authenticator failed for (ADMIN) [146.70.59.36]:46349: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 20:45:59 host2 sshd[3643663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov  2 20:46:40 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<K1XpFZ5Clf/CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  2 20:50:12 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, session=<FhiNIp5C9Fq4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  2 20:50:28 host2 dovecot[3500256]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, TLS: Connection closed, session=<Jq6BI55CtGC4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-02 20:51:33 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:58885: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-02 20:51:48 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-02 20:54:04 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:60165: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.93.69.193
country_id: 3469034
description:
2025-11-02 20:54:05 dovecot_login authenticator failed for ([190.93.69.193]) [190.93.69.193]:36970: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-02 20:53:51 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:35054: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.37
country_id: 6252001
description:
2025-11-02 20:57:01 dovecot_login authenticator failed for (ADMIN) [95.181.238.37]:33768: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Nov  2 21:08:30 host2 dovecot[3500256]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p4v8Y55C8r9BMQHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-11-02 21:08:33 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (dense) [37.150.8.174]:41086: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.45.177.25
country_id: 357994
description:
2025-11-02 21:08:36 dovecot_plain authenticator failed for (dialk) [41.45.177.25]:55888: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Nov  2 21:08:48 host2 dovecot[3500256]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wFITZZ5CEiNBMQHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-11-02 21:12:33 dovecot_plain authenticator failed for (inness) [65.20.184.80]:44172: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-02 21:14:08 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:56475: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.226.80.143
country_id: 6252001
description:
2025-11-02 21:14:25 dovecot_login authenticator failed for dhcp-011-143.coonvalley.mwt.net [216.226.80.143]:33582: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-11-02 21:14:31 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:37534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.57
country_id: 2635167
description:
2025-11-02 21:15:25 dovecot_login authenticator failed for (ADMIN) [158.173.23.57]:58197: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-02 21:15:00 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:33008: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-11-02 21:16:22 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:59298: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-11-02 21:16:55 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:58874: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-11-02 21:18:44 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:56906: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-02 21:18:57 dovecot_plain authenticator failed for (eportivers) [90.161.217.228]:57670: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-11-02 21:21:17 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:58955: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-02 21:21:34 dovecot_login authenticator failed for ([128.106.196.150]) [128.106.196.150]:45391: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Nov  2 21:23:32 host2 sshd[3686844]: Disconnected from invalid user roman 20.46.50.43 port 39536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-02 21:23:44 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:45998: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-02 21:23:58 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:54523: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Nov  2 21:26:24 host2 sshd[3689803]: Disconnected from invalid user admin 20.46.50.43 port 55052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.108.77
country_id: 2077456
description:
2025-11-02 21:26:42 dovecot_login authenticator failed for ([123.209.108.77]) [123.209.108.77]:57010: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-02 21:27:14 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:45500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.236.67.141
country_id: 6252001
description:
2025-11-02 21:27:23 dovecot_login authenticator failed for user-24-236-67-141.knology.net [24.236.67.141]:49374: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-02 21:26:46 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:40595: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-11-02 21:26:55 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:49516: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-02 21:27:00 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:41612: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.201
country_id: 6252001
description:
Nov  2 21:29:13 host2 pure-ftpd[3692386]: (?@147.185.132.201) [INFO] New connection from 147.185.132.201


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Nov  2 21:29:27 host2 sshd[3692635]: Disconnected from invalid user sipwise 20.46.50.43 port 45576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-02 21:30:09 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:49328: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Nov  2 21:30:59 host2 sshd[3694374]: Disconnected from invalid user mm 20.46.50.43 port 43956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-02 21:33:07 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:33032: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.39.153.63
country_id: 6252001
description:
2025-11-02 21:33:37 dovecot_plain authenticator failed for c-73-39-153-63.hsd1.dc.comcast.net (preace) [73.39.153.63]:46347: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
country_id: 1819730
description:
2025-11-02 21:34:23 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:63222: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-02 21:34:40 dovecot_plain authenticator failed for (copolan) [102.53.15.17]:54042: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-11-02 21:35:21 dovecot_login authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:48974: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-02 21:34:49 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:44473: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-02 21:37:42 dovecot_plain authenticator failed for (inonporyic) [24.105.248.218]:60528: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-02 21:36:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63553: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.50
country_id: 6252001
description:
2025-11-02 21:38:07 dovecot_login authenticator failed for (ADMIN) [95.181.238.50]:58068: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-02 21:37:47 dovecot_plain authenticator failed for (prefus) [103.51.26.198]:52823: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-11-02 21:39:49 dovecot_login authenticator failed for ([49.204.232.244]) [49.204.232.244]:55498: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov  2 21:50:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.132.238, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JKsK+55CqtaTuYTu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.20
country_id: 6252001
description:
Nov  2 21:50:51 host2 pure-ftpd[3717511]: (?@198.235.24.20) [INFO] New connection from 198.235.24.20


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov  2 21:51:38 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.132.238, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<FsxH/p5CSv2TuYTu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-02 21:52:03 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (nonorm) [24.127.53.61]:37868: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov  2 21:52:03 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.132.238, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<vu28/55CdOSTuYTu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-02 21:53:15 dovecot_plain authenticator failed for (pativelass) [92.62.243.174]:37329: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov  2 21:56:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.238, lip=66.85.158.92, TLS, session=<ecqHEJ9CqPiTuYTu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Nov  2 21:55:58 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS: Connection closed, session=<YbjIDZ9CxBNBMQGi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.22
country_id: 3042225
description:
2025-11-02 21:56:07 dovecot_login authenticator failed for (ADMIN) [91.90.124.22]:49008: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Nov  2 21:57:37 host2 sshd[3736344]: Disconnected from invalid user test 89.44.137.176 port 35640 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov  2 21:58:14 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.238, lip=66.85.158.92, TLS, session=<mmPYFZ9C+PKTuYTu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 21:59:34 host2 sshd[3738411]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-11-02 22:00:03 dovecot_plain authenticator failed for (zoothpro) [46.10.210.68]:33061: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-02 22:00:20 dovecot_plain authenticator failed for (wheify) [65.20.153.146]:56977: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-02 22:01:11 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (parrea) [73.195.211.98]:55036: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-02 22:03:15 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:37183: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.170
country_id: 1269750
description:
2025-11-02 22:03:58 dovecot_login authenticator failed for (nsg-static-121.34.76.182-airtel.com) [182.78.93.170]:43624: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-02 22:09:37 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (uncomin) [73.213.237.28]:41322: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.92.201
country_id: 2802361
description:
Nov  2 22:10:43 host2 pure-ftpd[3750482]: (?@34.140.92.201) [INFO] New connection from 34.140.92.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-11-02 22:12:41 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:49484: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 22:17:23 host2 sshd[3757095]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-11-02 22:20:43 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:50014: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-11-02 22:20:22 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:38818: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.244.152.105
country_id: 6252001
description:
Nov  2 22:20:36 host2 pure-ftpd[3760538]: (?@143.244.152.105) [INFO] New connection from 143.244.152.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.7
country_id: 2562770
description:
2025-11-02 22:22:38 dovecot_login authenticator failed for (ADMIN) [176.125.230.7]:41324: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-02 22:24:06 dovecot_plain authenticator failed for (trable) [65.20.186.177]:35473: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.57
country_id: 2635167
description:
Nov  2 22:25:14 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.57, lip=66.85.158.91, TLS, session=<GQhodp9CgaxX7LA5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.48.94.238
country_id: 3469034
description:
Nov  2 22:31:31 host2 sshd[3772852]: Disconnected from invalid user teamspeak 179.48.94.238 port 59318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-02 22:32:31 dovecot_plain authenticator failed for (acking) [102.53.15.18]:37343: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Nov  2 22:33:29 host2 sshd[3774737]: Disconnected from invalid user yao 67.10.185.103 port 50404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.48.94.238
country_id: 3469034
description:
Nov  2 22:35:51 host2 sshd[3777162]: Disconnected from invalid user edwin 179.48.94.238 port 53992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Nov  2 22:36:10 host2 sshd[3777437]: Disconnected from invalid user dev 67.10.185.103 port 53734 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 22:36:50 host2 sshd[3778230]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.26
country_id: 130758
description:
Nov  2 22:38:04 host2 sshd[3779460]: Disconnected from invalid user ftpuser1 37.32.13.26 port 58934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.205.219.185
country_id: 690791
description:
Nov  2 22:38:58 host2 sshd[3780259]: Disconnected from invalid user mobile 91.205.219.185 port 56498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.6.210
country_id: 1269750
description:
2025-11-02 22:39:53 dovecot_plain authenticator failed for (stracula) [182.156.6.210]:46742: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.205.219.185
country_id: 690791
description:
Nov  2 22:41:18 host2 sshd[3782748]: Disconnected from invalid user test 91.205.219.185 port 55180 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.205.219.185
country_id: 690791
description:
Nov  2 22:43:29 host2 sshd[3784795]: Disconnected from invalid user test 91.205.219.185 port 60616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.13.26
country_id: 130758
description:
Nov  2 22:43:45 host2 sshd[3785065]: Disconnected from invalid user siva 37.32.13.26 port 54580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-11-02 22:43:59 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (tally) [73.161.96.107]:54928: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  2 22:44:17 host2 sshd[3785533]: Disconnected from invalid user frappe 177.229.197.38 port 41142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.205.219.185
country_id: 690791
description:
Nov  2 22:45:38 host2 sshd[3787576]: Disconnected from invalid user bc 91.205.219.185 port 57794 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.199.111.92
country_id: 6252001
description:
[2025-11-02 22:49:21 +0530] info [cpaneld] 24.199.111.92 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.32.13.26
country_id: 130758
description:
Nov  2 22:50:28 host2 sshd[3792433]: Disconnected from invalid user vbox 37.32.13.26 port 40140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-02 22:53:02 dovecot_plain authenticator failed for (vologs) [102.53.15.17]:52073: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov  2 23:00:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, session=<NbZy9Z9CPrRKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.238.55.194
country_id: 6252001
description:
2025-11-02 23:01:36 dovecot_plain authenticator failed for (mical) [50.238.55.194]:37355: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.212
country_id: 6252001
description:
Nov  2 23:06:07 host2 pure-ftpd[3809743]: (?@64.62.156.212) [INFO] New connection from 64.62.156.212


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Nov  2 23:07:50 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MN3LDqBCKtGTuYUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Nov  2 23:08:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<qFYeEqBCJuiTuYUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov  2 23:09:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<SKYcFKBCWrpChJl2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.240
country_id: 6252001
description:
Nov  2 23:13:32 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.240, lip=66.85.158.92, session=<CWMtI6BCQbFAPsXw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Nov  2 23:13:45 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, TLS: Connection closed, session=<KJLsI6BCpOlAPsXj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Nov  2 23:14:15 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS, session=<hfW6JaBC4PiTuYUL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-02 23:16:38 dovecot_plain authenticator failed for 81-234-121-57-no600.tbcn.telia.com (unhers) [81.234.121.57]:49058: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.37
country_id: 3469034
description:
2025-11-02 23:24:35 dovecot_login authenticator failed for (ADMIN) [146.70.98.37]:34694: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.42.208.47
country_id: 1880251
description:
Nov  2 23:26:44 host2 pure-ftpd[3833146]: (?@152.42.208.47) [INFO] New connection from 152.42.208.47


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 23:31:35 host2 sshd[3838112]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-02 23:32:28 dovecot_plain authenticator failed for (bards) [65.20.160.107]:48824: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-02 23:35:43 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (rings) [73.195.211.98]:34386: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov  2 23:39:10 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, TLS: Connection closed, session=<3J7TfqBCFL1ChJmF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.34.102
country_id: 6251999
description:
Nov  2 23:39:12 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=159.203.34.102, lip=66.85.158.92, TLS, session=<Z67vfqBCxIufyyJm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.224.221.89
country_id: 6252001
description:
Nov  2 23:45:18 host2 pure-ftpd[3852140]: (?@34.224.221.89) [INFO] New connection from 34.224.221.89


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov  2 23:52:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<rC+VrqBCgLtBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov  2 23:52:44 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, TLS: Connection closed, session=<nB5gr6BCwD5BMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-02 23:55:09 dovecot_plain authenticator failed for (liedi) [14.139.107.146]:33376: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-11-02 23:57:41 dovecot_plain authenticator failed for (anceore) [199.192.123.12]:48050: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-11-02 23:58:45 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (suped) [174.58.87.108]:57986: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.245
country_id: 6252001
description:
Nov  3 00:02:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=69.164.217.245, lip=66.85.158.91, session=<QMzn0qBClYVFpNn1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-11-03 00:03:42 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (prole) [68.40.189.43]:59402: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov  3 00:05:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gr/q3aBCznRBMQHK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 177.157.246.12
country_id: 3469034
description:
Nov  3 00:07:04 host2 pure-ftpd[3874944]: (?@177.157.246.12) [INFO] New connection from 177.157.246.12


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 00:08:38 host2 sshd[3876485]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-11-03 00:10:13 dovecot_plain authenticator failed for (themigase) [199.192.123.12]:60724: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-03 00:11:35 dovecot_plain authenticator failed for (parler) [84.238.92.245]:42049: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-03 00:11:39 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (pateoutia) [217.215.74.195]:39343: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-03 00:15:56 dovecot_plain authenticator failed for (verigmelt) [154.144.243.93]:35162: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-03 00:15:59 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (derivy) [217.215.74.195]:54125: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.19
country_id: 3042058
description:
2025-11-03 00:19:52 dovecot_login authenticator failed for (ADMIN) [91.90.122.19]:46482: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.102.15
country_id: 6252001
description:
Nov  3 00:21:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.102.15, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mfj6FaFCDJSl42YP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-11-03 00:33:18 dovecot_plain authenticator failed for (dogutic) [109.226.27.227]:45527: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-03 00:36:27 dovecot_plain authenticator failed for (mifing) [182.95.174.18]:58698: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-03 00:35:55 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (phlerry) [87.103.126.54]:17397: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.70
country_id: 3996063
description:
2025-11-03 00:40:57 dovecot_login authenticator failed for (ADMIN) [77.81.142.70]:6354: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-11-03 00:54:05 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (rerms) [98.193.112.85]:59614: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-11-03 00:59:02 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:56606: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-11-03 00:59:16 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:53554: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-03 01:00:32 dovecot_plain authenticator failed for (grosast) [102.53.15.56]:59519: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-03 01:00:16 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (sounvus) [73.208.81.125]:60560: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.58
country_id: 660013
description:
2025-11-03 01:02:35 dovecot_login authenticator failed for (ADMIN) [188.126.89.58]:56733: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 01:03:08 host2 sshd[3936900]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.238.55.194
country_id: 6252001
description:
2025-11-03 01:18:46 dovecot_plain authenticator failed for (irratess) [50.238.55.194]:26817: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 223.122.200.97
country_id: 1819730
description:
Nov  3 01:22:40 host2 sshd[3958146]: Disconnecting authenticating user root 223.122.200.97 port 39126: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 223.122.200.97
country_id: 1819730
description:
Nov  3 01:22:40 host2 sshd[3958146]: error: maximum authentication attempts exceeded for root from 223.122.200.97 port 39126 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.122.200.97
country_id: 1819730
description:
Nov  3 01:22:54 host2 sshd[3958408]: Disconnecting invalid user admin 223.122.200.97 port 56386: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-11-03 01:24:57 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (hynoid) [24.15.216.41]:58066: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov  3 01:27:00 host2 pure-ftpd[3962612]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.208
country_id: 6252001
description:
2025-11-03 01:27:40 dovecot_login authenticator failed for (ADMIN) [212.32.49.208]:31028: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-03 01:30:06 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (chemisated) [73.13.220.220]:54442: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.53.204
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 95.164.53.204 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-11-03 01:34:02 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (hamardilip) [76.16.7.82]:50363: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 01:40:13 host2 sshd[3975325]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-03 01:43:07 dovecot_plain authenticator failed for (demomenic) [65.20.164.137]:56433: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-03 01:44:07 dovecot_plain authenticator failed for (nogged) [62.73.121.209]:57880: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 01:46:02 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58512: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-11-03 01:48:09 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:49439: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-11-03 01:48:26 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:46374: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.24
country_id: 6252001
description:
2025-11-03 01:51:32 dovecot_login authenticator failed for (ADMIN) [95.181.238.24]:55502: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-03 02:05:34 dovecot_plain authenticator failed for 5.185.189.151.ipv4.public.orange.pl (tivole) [5.185.189.151]:35676: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 02:08:43 host2 sshd[4005571]: Disconnected from invalid user user 2.57.121.25 port 25094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.108
country_id: 2661886
description:
2025-11-03 02:13:02 dovecot_login authenticator failed for (ADMIN) [46.246.8.108]:25596: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-03 02:22:59 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:53198: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-11-03 02:23:29 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:47598: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-03 02:23:52 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:54606: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-03 02:25:26 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (beroly) [98.40.101.10]:47126: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Nov  3 02:32:11 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jE+Z6aJCKMfG6xhH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.50
country_id: 2077456
description:
2025-11-03 02:34:11 dovecot_login authenticator failed for (ADMIN) [179.61.228.50]:57464: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-11-03 02:35:14 dovecot_plain authenticator failed for (callogedis) [65.20.184.80]:38058: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 02:34:56 host2 sshd[4031244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-11-03 02:36:04 dovecot_plain authenticator failed for (saffer) [88.149.153.106]:35972: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.136
country_id: 6252001
description:
Nov  3 02:45:38 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.136, lip=66.85.158.92, session=<i922GaNCzvtC5DWI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-03 02:51:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (obeakous) [87.103.126.54]:17387: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-03 02:55:38 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:54400: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-03 03:03:58 dovecot_plain authenticator failed for (yohed) [46.8.240.26]:35908: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-03 03:04:59 dovecot_plain authenticator failed for (pentanited) [92.62.243.154]:41484: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-11-03 03:05:01 dovecot_plain authenticator failed for (ocodiphro) [75.97.190.237]:51989: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-03 03:05:05 dovecot_plain authenticator failed for (catefic) [5.76.44.40]:54453: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-03 03:06:27 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:45214: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-11-03 03:06:46 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:33910: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 03:12:13 host2 sshd[4072008]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-03 03:15:46 dovecot_plain authenticator failed for (grankete) [24.187.213.29]:60630: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.29
country_id: 2542007
description:
2025-11-03 03:16:34 dovecot_login authenticator failed for (ADMIN) [95.181.232.29]:62426: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 03:18:23 host2 sshd[4080249]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-11-03 03:20:02 dovecot_plain authenticator failed for (deria) [65.20.148.194]:43134: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-03 03:29:20 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (sposiel) [67.172.54.29]:36348: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-03 03:31:12 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:52912: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-11-03 03:31:47 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:58566: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.55
country_id: 798544
description:
2025-11-03 03:37:34 dovecot_login authenticator failed for (ADMIN) [138.199.59.55]:57606: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.52
country_id: 6252001
description:
Nov  3 03:40:11 host2 pure-ftpd[4103029]: (?@147.185.132.52) [INFO] New connection from 147.185.132.52


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Nov  3 03:47:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.244, lip=66.85.158.91, TLS, session=<kXGX96NCCvDN0h/0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-03 03:50:01 dovecot_plain authenticator failed for (mintornin) [46.8.245.34]:36230: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.114
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.114: 250 connections per 30 seconds to 8443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.114
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.114: 438 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-11-03 03:59:20 dovecot_plain authenticator failed for (whisecry) [102.53.15.180]:42135: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.123.204
country_id: 6252001
description:
Nov  3 04:00:14 host2 pure-ftpd[4125635]: (?@135.237.123.204) [INFO] New connection from 135.237.123.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.103
country_id: 3865483
description:
2025-11-03 04:02:50 dovecot_login authenticator failed for (ADMIN) [146.70.38.103]:46146: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 04:06:59 host2 sshd[4133379]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 04:16:56 host2 sshd[4145023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov  3 04:18:53 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<66EwZ6RC5tuLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.72
country_id: 6252001
description:
Nov  3 04:19:54 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.72, lip=66.85.158.91, TLS, session=<MsTPaqRCNujG6xhI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.94
country_id: 390903
description:
2025-11-03 04:27:57 dovecot_login authenticator failed for (ADMIN) [79.127.181.94]:56678: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-03 04:35:16 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:54194: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-11-03 04:35:33 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:47379: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-11-03 04:36:58 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:39248: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-03 04:42:11 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:36280: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-03 04:42:26 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:39348: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Nov  3 04:43:34 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.94, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Muxzv6RCbtmTuYRe>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 04:44:12 host2 sshd[4181365]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-03 04:46:44 dovecot_plain authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net (aming) [50.127.177.194]:51731: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.146.226
country_id: 2017370
description:
2025-11-03 04:50:31 dovecot_login authenticator failed for (91.200.146-226.in-addr.netone.ru) [91.200.146.226]:59214: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-03 04:50:58 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:44102: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.101
country_id: 6252001
description:
Nov  3 04:53:39 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.155.101, lip=66.85.158.91, TLS: Connection closed, session=<PFyE46RCtI7HLZtl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.44
country_id: 6252001
description:
2025-11-03 04:53:53 dovecot_login authenticator failed for (ADMIN) [158.173.25.44]:42762: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 04:58:26 host2 sshd[4029]: Disconnected from invalid user user 2.57.121.25 port 23155 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-03 05:07:32 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:42430: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.78.112
country_id: 3017382
description:
2025-11-03 05:07:12 dovecot_login authenticator failed for 217-128-78-112.ftth.fr.orangecustomers.net [217.128.78.112]:50803: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-03 05:08:06 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:53970: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.249.27.167
country_id: 1880251
description:
2025-11-03 05:10:26 dovecot_login authenticator failed for (YDRssR) [23.249.27.167]:57520: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Nov  3 05:14:10 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V1HrLKVC4NbN0h9T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.208
country_id: 6252001
description:
2025-11-03 05:14:32 dovecot_login authenticator failed for (ADMIN) [173.244.56.208]:35763: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.44.143.75
country_id: 3175395
description:
2025-11-03 05:17:20 dovecot_plain authenticator failed for 93-44-143-75.ip97.fastwebnet.it (symel) [93.44.143.75]:45788: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 05:20:55 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51324: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.194
country_id: 2960313
description:
2025-11-03 05:34:59 dovecot_login authenticator failed for (ADMIN) [37.46.113.194]:45080: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 05:39:02 host2 sshd[49565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-03 05:50:10 dovecot_login authenticator failed for ([187.58.241.90]) [187.58.241.90]:48738: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-03 05:50:37 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:52796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-03 05:50:52 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:43760: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.40
country_id: 6252001
description:
Nov  3 06:04:37 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.40, lip=66.85.158.92, session=<cvBK4aVCpP3G6xgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.21
country_id: 798549
description:
2025-11-03 06:05:24 dovecot_login authenticator failed for (ADMIN) [143.244.54.21]:12632: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 06:16:18 host2 sshd[88364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:25:04 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, TLS, session=<dMB4KqZCAp1Zu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 06:24:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<y4A4KKZCQOO81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.9
country_id: 1282988
description:
Nov  3 06:24:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.33.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Pcc3KKZCFrqt9CEJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 06:25:00 host2 pure-ftpd[97160]: (?@217.138.193.188) [INFO] New connection from 217.138.193.188


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 06:25:04 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, TLS, session=<LL50KqZCwLWyr46D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.153
country_id: 3042058
description:
Nov  3 06:24:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.153, lip=66.85.158.91, session=<cXI0KKZC+o1bWnqZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.7
country_id: 1168579
description:
Nov  3 06:24:27 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.12.7, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8Gc4KKZCxO2SRgwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.12
country_id: 718075
description:
Nov  3 06:25:04 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=185.225.28.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jLd3KqZCAJ254RwM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-11-03 06:25:55 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:57626: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.53
country_id: 3703430
description:
2025-11-03 06:26:06 dovecot_login authenticator failed for (ADMIN) [91.90.126.53]:53706: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 06:26:25 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, TLS, session=<7SdGL6ZCSJKwfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 06:26:57 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, session=<rzMtMaZCAMNftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.7
country_id: 1168579
description:
Nov  3 06:26:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.12.7, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jz02MaZCDtySRgwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.141
country_id: 289688
description:
Nov  3 06:26:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.141, lip=66.85.158.91, session=<8dKNMKZC/O1fteqN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.12
country_id: 718075
description:
Nov  3 06:26:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.225.28.12, lip=66.85.158.91, TLS, session=<BUU1MaZCGNy54RwM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS, session=<jNczMaZCbKMfq5hp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 06:26:20 host2 pure-ftpd[98577]: (?@95.181.232.142) [INFO] New connection from 95.181.232.142


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:26:22 host2 pure-ftpd[98630]: (?@89.187.162.180) [INFO] New connection from 89.187.162.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.250
country_id: 719819
description:
Nov  3 06:26:44 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=86.106.74.250, lip=66.85.158.91, session=<4P5tMKZCwLpWakr6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 06:26:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, session=<B2lbL6ZCMocthtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.3
country_id: 3277605
description:
Nov  3 06:26:23 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.36.3, lip=66.85.158.91, TLS, session=<oZImL6ZCOqJinyQD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DVsoL6ZCUudbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.21
country_id: 3923057
description:
Nov  3 06:26:25 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TdxFL6ZCQpItmpkV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.78
country_id: 390903
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=79.127.175.78, lip=66.85.158.91, TLS, session=<IN8oL6ZCYudPf69O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.9
country_id: 1282988
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.244.33.9, lip=66.85.158.91, session=<X3wxMaZC0LWt9CEJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 06:26:44 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<dB5xMKZCsrql57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 06:26:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sv6IMKZClMOSRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<1AU3MaZCNLeVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.8
country_id: 1327865
description:
Nov  3 06:26:23 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=98.159.41.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rMMnL6ZCOKJinykI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, session=<IJspL6ZCRvKKxyei>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 06:26:24 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<cfw/L6ZCZNmVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.4
country_id: 718075
description:
Nov  3 06:26:45 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.225.28.4, lip=66.85.158.91, TLS, session=<yeZyMKZCQtq54RwE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 06:27:11 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<5+QKMqZCJsFfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 06:26:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TFwzMaZCaKNfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 06:26:23 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, session=<FA4pL6ZC7OfE9TYN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 06:27:06 host2 pure-ftpd[99546]: (?@176.125.229.144) [INFO] New connection from 176.125.229.144


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 06:27:34 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, session=</xxqM6ZCeMqwfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 06:27:57 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<jofGNKZCiOmVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 79.127.175.78
country_id: 390903
description:
Nov  3 06:27:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=79.127.175.78, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qAjdNKZCiKdPf69O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 06:27:36 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4IF/M6ZCULzZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 06:27:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p3rKNKZCdJeVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 06:27:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=89.187.162.103, lip=66.85.158.91, session=<YyvLNKZCaulZu6Jn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 06:31:43 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<pk08QqZCkMFHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 06:31:44 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<GjRRQqZClsRHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.231
country_id: 718075
description:
2025-11-03 06:48:09 dovecot_login authenticator failed for (ADMIN) [185.225.28.231]:13217: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 06:58:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AM0HoaZCUKUfq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 06:58:14 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, session=<5u4PoaZCoJfZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:58:15 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+5UfoaZCZoRZu6K0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 06:58:11 host2 pure-ftpd[133026]: (?@89.187.162.180) [INFO] New connection from 89.187.162.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 06:58:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, TLS, session=<oVgHoaZCXqVftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 06:58:14 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<7cEJoaZCqJdfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.39
country_id: 458258
description:
Nov  3 07:01:06 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=196.196.53.39, lip=66.85.158.91, session=<+v9Xq6ZCrJzExDUn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:01:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<+OJbq6ZCppyVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:01:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9P1vq6ZCjL4thMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 07:01:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<o1pzq6ZCfMJZu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 07:01:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mnZvraZCfLxfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uTNoraZCSYxfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 07:01:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RPNUraZCiM6SRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:01:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<2TVaraZCDuyVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.85
country_id: 3057568
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.85, lip=66.85.158.91, session=<0bRjraZCzOmVZuhV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<tcVgraZC1uml57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:01:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, TLS, session=<8FBVraZClM4thMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:01:40 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, session=<vJZVraZCFOzZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.139
country_id: 3686110
description:
Nov  3 07:01:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.16.139, lip=66.85.158.91, TLS, session=<+CRpraZCoMqaLxCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:02:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, TLS, session=<jJXxsKZCVuS81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 158.173.158.81
country_id: 3017382
description:
Nov  3 07:02:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=158.173.158.81, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ouvvsKZCUOSerZ5R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:02:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<x0IFsaZCrLeKxyei>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 07:02:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, session=<T9cAsaZCLN2SRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:04:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ANXPtqZCsKW81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:04:20 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<9TTctqZC6p6l57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.3
country_id: 3277605
description:
Nov  3 07:04:19 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=98.159.36.3, lip=66.85.158.91, session=<G3TZtqZC8p5inyQD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.10
country_id: 3508796
description:
Nov  3 07:04:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.244.32.10, lip=66.85.158.91, TLS, session=<XyIbuKZCwr2t9CAK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:04:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, session=<0XnNtqZCuIOyr46D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:04:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, session=<Z8bOtqZCtrfCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:04:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, TLS, session=<y0LQtqZCHODZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 07:04:41 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<f7sbuKZCaLuwfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.16
country_id: 130758
description:
Nov  3 07:04:18 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=62.133.46.16, lip=66.85.158.91, session=<+TXKtqZC3OQ+hS4Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 07:04:18 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<tcfJtqZC7I9Zu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<6qkKvKZCpTm81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.208
country_id: 2782113
description:
Nov  3 07:05:47 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=37.19.223.208, lip=66.85.158.91, session=<RyAOvKZC0KQlE9/Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.148
country_id: 1835841
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.42.148, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JaMKvKZCKL2t9CqU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:05:41 host2 pure-ftpd[141871]: (?@217.138.193.188) [INFO] New connection from 217.138.193.188


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:05:42 host2 pure-ftpd[141875]: (?@188.215.235.43) [INFO] New connection from 188.215.235.43


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:05:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, session=<AY38u6ZCApSl57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:05:47 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EIsNvKZCKrJfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zvANvKZCWteyr46D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 07:05:48 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, session=<Th8ivKZCFrNftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 07:05:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, TLS, session=<CKoNvKZCatdbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.10
country_id: 1282988
description:
Nov  3 07:05:45 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.244.33.10, lip=66.85.158.91, session=<iWH4u6ZCEJSt9CEK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:05:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<rscHvKZCRuaVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, session=<4nP3vaZCvoXCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<bCX4vaZCQpGVWBpG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.139
country_id: 3686110
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=154.47.16.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ykj5vaZCkoOaLxCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.25
country_id: 2542007
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.232.25, lip=66.85.158.91, session=<J2L0vaZCTshftegZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 07:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, session=<yI70vaZCjOvE9TYN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0GP9vaZCuKEfq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.39
country_id: 458258
description:
Nov  3 07:06:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=196.196.53.39, lip=66.85.158.91, TLS, session=<Cd/4vaZCTtnExDUn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, TLS, session=<OLz1wqZCwpMthtWl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:07:52 host2 pure-ftpd[144312]: (?@84.247.105.126) [INFO] New connection from 84.247.105.126


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.139
country_id: 3686110
description:
Nov  3 07:07:57 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=154.47.16.139, lip=66.85.158.91, session=<Nd/Lw6ZCzqqaLxCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:07:57 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<tO/Qw6ZCyKq81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:07:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, TLS handshaking: Connection closed, session=</4/Qw6ZCNogfq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:08:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.247.105.126, lip=66.85.158.91, session=<37+/xKZC+KRU92l+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:07:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<ICXqwqZCnIeVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:08:13 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, session=<xVfCxKZCQq+VWBpG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:08:09 host2 pure-ftpd[144721]: (?@217.138.193.188) [INFO] New connection from 217.138.193.188


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:08:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<743BxKZCvoXCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 07:07:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0iPowqZCQONbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, session=<J7zzwqZCisUthMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:07:57 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.175.142.131, lip=66.85.158.91, TLS, session=<XXjQw6ZCOIiyr46D>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:08:10 host2 pure-ftpd[144732]: (?@138.199.39.162) [INFO] New connection from 138.199.39.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.42.148
country_id: 1835841
description:
Nov  3 07:07:40 host2 pure-ftpd[144215]: (?@173.244.42.148) [INFO] New connection from 173.244.42.148


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.151
country_id: 453733
description:
Nov  3 07:07:42 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=165.231.182.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FLbowqZCkpKl57aX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.21
country_id: 3923057
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9Iv1wqZCspMtmpkV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.3
country_id: 3277605
description:
Nov  3 07:07:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.36.3, lip=66.85.158.91, session=<HJb2wqZCaMVinyQD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 07:08:36 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=89.187.162.103, lip=66.85.158.91, session=<WfUgxqZC2IRZu6Jn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 07:10:14 host2 pure-ftpd[147000]: (?@89.187.162.103) [INFO] New connection from 89.187.162.103


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.175.142.131
country_id: 617790
description:
Nov  3 07:10:14 host2 pure-ftpd[146968]: (?@178.175.142.131) [INFO] New connection from 178.175.142.131


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:10:28 host2 pure-ftpd[147128]: (?@138.199.39.162) [INFO] New connection from 138.199.39.162


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 07:11:14 host2 sshd[147924]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:10:30 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, session=<0dPyzKZCPI/CIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.85
country_id: 3057568
description:
Nov  3 07:10:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.85, lip=66.85.158.91, TLS handshaking: Connection closed, session=<l4f6zKZCXMOVZuhV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:10:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS, session=<qwf8zKZCasOKxyei>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.178
country_id: 2635167
description:
2025-11-03 07:10:40 dovecot_login authenticator failed for (ADMIN) [158.173.23.178]:18871: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:10:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<0vs9zKZCMMy81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.209
country_id: 6252001
description:
Nov  3 07:10:18 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.209, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SIY7zKZCQsLN0h/R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 07:10:30 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.229.144, lip=66.85.158.91, session=<7UP2zKZCLI+wfeWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.180
country_id: 1880251
description:
Nov  3 07:10:31 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=89.187.162.180, lip=66.85.158.91, session=<af/5zKZCHrJZu6K0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.140
country_id: 3042058
description:
Nov  3 07:12:07 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.140, lip=66.85.158.91, session=<ppaz0qZCFsNbWnqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:12:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=84.247.105.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<t4yf0qZCvsVU92l+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.188
country_id: 290557
description:
Nov  3 07:12:06 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=217.138.193.188, lip=66.85.158.91, session=<fIqh0qZCrIDZisG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:12:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, session=<ffO00qZC2L4thtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:12:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.232.142, lip=66.85.158.91, TLS, session=<Trif0qZCwsVfteiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:12:07 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, session=<Vcux0qZC6L4fq5hp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:12:07 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, TLS, session=<wg630qZCJq+VWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.187.162.103
country_id: 1880251
description:
Nov  3 07:11:56 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=89.187.162.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kHkP0qZCVIlZu6Jn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 07:12:06 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, session=<ut+l0qZCqoDE9TYN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:11:52 host2 pure-ftpd[148604]: (?@95.181.232.142) [INFO] New connection from 95.181.232.142


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:11:56 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS, session=<j7AP0qZCeImKxyei>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.142
country_id: 2542007
description:
Nov  3 07:14:13 host2 pure-ftpd[150810]: (?@95.181.232.142) [INFO] New connection from 95.181.232.142


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  3 07:14:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<8X3l2aZCWt2LonQW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:14:37 host2 pure-ftpd[151181]: (?@45.134.213.165) [INFO] New connection from 45.134.213.165


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.126
country_id: 6251999
description:
Nov  3 07:14:43 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=84.247.105.126, lip=66.85.158.91, TLS, session=<lpUE3KZCNstU92l+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 07:14:50 host2 sshd[151357]: Disconnected from invalid user user 2.57.121.25 port 36425 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.11
country_id: 2328926
description:
Nov  3 07:14:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.65.11, lip=66.85.158.91, TLS, session=<8nlk2qZCNJSSRkEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.85
country_id: 3057568
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.85, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nxtn2qZCsMiVZuhV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.4
country_id: 1227603
description:
Nov  3 07:14:17 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.40.4, lip=66.85.158.91, session=<T/x62qZCTtFinygE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.70
country_id: 294640
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.88.26.70, lip=66.85.158.91, TLS, session=<Y7hn2qZCvMiVWBpG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.144
country_id: 3194884
description:
Nov  3 07:14:40 host2 pure-ftpd[151195]: (?@176.125.229.144) [INFO] New connection from 176.125.229.144


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.14
country_id: 597427
description:
Nov  3 07:14:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=194.32.122.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<CT4F3KZCjsfCIHoO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.245.54.13
country_id: 2510769
description:
Nov  3 07:14:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=196.245.54.13, lip=66.85.158.91, TLS, session=<Z/QE3KZCnsfE9TYN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, session=<zYZh2qZC7qMthtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.39.162
country_id: 1861060
description:
Nov  3 07:14:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=138.199.39.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NPtl2qZCMpSKxyei>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Nov  3 07:14:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, session=<NGFm2qZC4qNfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.105
country_id: 783754
description:
Nov  3 07:14:43 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.171.152.105, lip=66.85.158.91, session=<byMD3KZC5tcfq5hp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.43
country_id: 1831722
description:
Nov  3 07:14:41 host2 pure-ftpd[151229]: (?@188.215.235.43) [INFO] New connection from 188.215.235.43


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.141
country_id: 289688
description:
Nov  3 07:14:40 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.234.141, lip=66.85.158.91, TLS, session=<V4XZ26ZCdslfteqN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.65
country_id: 294640
description:
Nov  3 07:14:41 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.88.26.65, lip=66.85.158.91, session=<A5/j26ZC6OaVWBpB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.213.34.5
country_id: 298795
description:
Nov  3 07:15:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.213.34.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tUIS3qZCQqy81SIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.165
country_id: 2510769
description:
Nov  3 07:15:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.134.213.165, lip=66.85.158.91, TLS, session=<EjsB3qZCTJEthtWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.64
country_id: 597427
description:
Nov  3 07:15:16 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.64, lip=66.85.158.91, session=<iTn/3aZCNKYthMJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.148
country_id: 1835841
description:
Nov  3 07:15:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=173.244.42.148, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NY8C3qZCPpGt9CqU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.225.33
country_id: 6252001
description:
Nov  3 07:19:26 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=20.15.225.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9WHa7KZCyOkUD+Eh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov  3 07:23:29 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=199.45.155.88, lip=66.85.158.91, TLS: Connection closed, session=<fCli+6ZC4KTHLZtY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-03 07:28:37 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:45520: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-03 07:28:50 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:57573: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.131.8.20
country_id: 1168579
description:
2025-11-03 07:29:21 dovecot_login authenticator failed for ([103.131.8.20]) [103.131.8.20]:38532: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.42
country_id: 3625428
description:
2025-11-03 07:35:49 dovecot_login authenticator failed for (ADMIN) [95.181.237.42]:52618: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov  3 07:38:12 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, TLS: Connection closed, session=<GfIGMKdCyoVo7NEL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov  3 07:37:48 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<h+KOLqdCXMBChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.166.43
country_id: 6252001
description:
Nov  3 07:38:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.84.166.43, lip=66.85.158.92, TLS, session=<bnOvL6dCkLkUVKYr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov  3 07:38:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<BBQ6MKdCAoZo7NEL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-03 07:47:01 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:35332: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-03 07:47:17 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:60427: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.219.229.99
country_id: 6252001
description:
2025-11-03 07:47:25 dovecot_login authenticator failed for (67-219-229-99.mycomspan.com) [67.219.229.99]:51321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.120.138
country_id: 298795
description:
2025-11-03 07:47:47 dovecot_login authenticator failed for (78.187.120.138.dynamic.ttnet.com.tr) [78.187.120.138]:52942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 07:48:32 host2 sshd[185004]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-03 07:54:37 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.32.248]:49978: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-11-03 07:54:42 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (cophagui) [174.166.153.20]:35310: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-03 07:54:51 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:41594: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 07:55:46 host2 sshd[192767]: Disconnected from invalid user presley 62.60.131.157 port 16864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.21
country_id: 3194884
description:
2025-11-03 07:59:41 dovecot_login authenticator failed for (ADMIN) [176.125.229.21]:41868: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-03 08:15:24 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (randrust) [73.197.236.163]:34650: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov  3 08:16:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS: Connection closed, session=<hKFiuKdCHt+nXpI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.64
country_id: 1814991
description:
2025-11-03 08:19:46 dovecot_login authenticator failed for (ADMIN) [188.241.80.64]:22363: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-11-03 08:22:12 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:47200: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2025-11-03 08:22:28 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:37146: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-11-03 08:24:31 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:46574: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-03 08:24:46 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:34660: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-03 08:25:09 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:39270: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 08:32:58 host2 sshd[232775]: Disconnected from invalid user user 2.57.121.25 port 35211 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov  3 08:40:51 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<J7sNEKhC1MhChJl0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 08:43:31 host2 sshd[245204]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.20
country_id: 174982
description:
2025-11-03 08:44:59 dovecot_login authenticator failed for (ADMIN) [185.253.160.20]:5190: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.115
country_id: 6252001
description:
Nov  3 08:45:18 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.115, lip=66.85.158.92, TLS, session=<rMPxH6hCDO6TuYRz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.224
country_id: 6252001
description:
Nov  3 08:48:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.224, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MdDkKahCsN7G6xjg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 08:50:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61301: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-03 08:53:28 dovecot_plain authenticator failed for (witass) [154.144.243.93]:52394: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.61
country_id: 1880251
description:
2025-11-03 09:05:33 dovecot_login authenticator failed for (ADMIN) [156.146.57.61]:15155: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-11-03 09:06:45 dovecot_plain authenticator failed for (elholve) [41.248.243.181]:42410: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov  3 09:15:14 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<SLUEi6hCMuItT4DN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 09:20:49 host2 sshd[290497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-03 09:40:51 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:50214: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-03 09:42:15 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:60030: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  3 09:44:02 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<e3sC8qhCEoBChJly>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  3 09:47:19 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.190.57, lip=66.85.158.91, TLS, session=<jBG9/ahCquKUcb45>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 09:53:51 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dQwcFalCD8Ki2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 09:54:59 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<w1QlGalC7vOi2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 10:01:11 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS, session=<MR1XL6lCcuOi2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.219
country_id: 6252001
description:
Nov  3 10:02:02 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.219, lip=66.85.158.92, TLS, session=<HD1iMqlC5vmi2JXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.56
country_id: 2635167
description:
Nov  3 10:06:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.211.56, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<uaWtQalCX9Ujy9M4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.56
country_id: 2635167
description:
Nov  3 10:07:18 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.56, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<XUM1RalCDu0jy9M4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.56
country_id: 2635167
description:
Nov  3 10:13:29 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.56, lip=66.85.158.91, TLS, session=<dapWW6lC3OUjy9M4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.51
country_id: 6252001
description:
Nov  3 10:15:42 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.104.11.51, lip=66.85.158.92, TLS, session=<r0Y9Y6lCYrisaAsz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  3 10:15:44 host2 sshd[349072]: Disconnected from invalid user user 2.57.121.25 port 12685 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-11-03 10:16:51 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (squia) [90.0.156.128]:51230: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-03 10:22:01 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:49566: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-03 10:22:20 dovecot_login authenticator failed for ([125.19.175.128]) [27.123.112.90]:50648: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-03 10:27:50 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (phity) [5.185.198.73]:43260: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-03 10:27:52 dovecot_plain authenticator failed for (graft) [65.20.191.12]:33238: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.61.119
country_id: 6252001
description:
Nov  3 10:31:59 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.61.119, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<EvJ/nalC5NwUoz13>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-03 10:34:44 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:36990: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-03 10:34:44 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:34740: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.217.64.148
country_id: 6252001
description:
Nov  3 10:33:56 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=48.217.64.148, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ggBzpKlCTrow2UCU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-03 10:35:08 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58155: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 290557
description:
2025-11-03 10:35:10 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:44450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-03 10:35:15 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:1800: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-11-03 10:35:29 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:59733: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-03 10:35:49 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:32902: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-11-03 10:38:14 dovecot_plain authenticator failed for (idilcory) [65.20.163.103]:34875: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.252
country_id: 2635167
description:
Nov  3 10:44:23 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.252, lip=66.85.158.92, TLS, session=<SN/YyalCsZy594n8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.232
country_id: 2782113
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.19.223.232, lip=66.85.158.91, TLS, session=<tRPlzalC6rklE9/o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.52
country_id: 357994
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.214.122.52, lip=66.85.158.91, session=<UPzkzalCgMC81no0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.213.34.5
country_id: 298795
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.213.34.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qlXlzalCmNG81SIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.20
country_id: 3923057
description:
Nov  3 10:45:31 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.20, lip=66.85.158.91, session=<UB/qzalCwIQtmpkU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.34.242.240
country_id: 2963597
description:
Nov  3 10:45:28 host2 pure-ftpd[379870]: (?@149.34.242.240) [INFO] New connection from 149.34.242.240


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.228.166
country_id: 2589581
description:
Nov  3 10:45:31 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=176.125.228.166, lip=66.85.158.91, session=<1dzhzalCqpGwfeSm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.130.252
country_id: 617790
description:
Nov  3 10:45:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=178.175.130.252, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QeHzzalCvtayr4L8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 181.214.218.123
country_id: 2802361
description:
Nov  3 10:45:28 host2 pure-ftpd[379902]: (?@181.214.218.123) [INFO] New connection from 181.214.218.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.172
country_id: 1819730
description:
Nov  3 10:45:31 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=84.17.56.172, lip=66.85.158.91, session=<aunlzalCoulUETis>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.135
country_id: 3194884
description:
Nov  3 10:45:32 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=176.125.229.135, lip=66.85.158.91, TLS, session=<4c7zzalC3sOwfeWH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.43
country_id: 617790
description:
2025-11-03 10:47:22 dovecot_login authenticator failed for (ADMIN) [178.175.128.43]:40228: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-03 10:48:06 dovecot_plain authenticator failed for (cafer) [65.20.160.107]:37842: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-03 10:48:09 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (sulan) [81.226.88.121]:51081: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Nov  3 10:58:03 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZVW2+qlC1sjG6xj4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.96
country_id: 2921044
description:
2025-11-03 11:07:20 dovecot_login authenticator failed for (ADMIN) [212.102.57.96]:61614: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  3 11:08:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: read(size=713) failed: Connection reset by peer, session=<mHA6H6pCcNlChJmC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.182.140.205
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 217.182.140.205 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov  3 11:13:25 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.207, lip=66.85.158.92, TLS, session=<SVmsMapCkOTG6xjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-03 11:17:51 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:51622: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-03 11:18:10 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:59286: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-03 11:32:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dercums) [87.103.126.54]:29601: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.65
country_id: 6252001
description:
2025-11-03 11:35:48 dovecot_login authenticator failed for (ADMIN) [181.215.182.65]:47958: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov  3 11:38:01 host2 pure-ftpd[437604]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.115.154
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 196.251.115.154 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  3 11:50:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS, session=<wC+stapCLI9ChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-03 11:59:07 dovecot_plain authenticator failed for (typenons) [87.200.226.113]:46917: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-03 12:00:22 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:36200: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-03 12:11:44 dovecot_plain authenticator failed for (stedavess) [65.20.205.197]:39165: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 12:11:57 host2 sshd[475931]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 12:20:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56839: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.93
country_id: 6252001
description:
2025-11-03 12:27:19 dovecot_login authenticator failed for (ADMIN) [156.146.39.93]:54670: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.25
country_id: 1605651
description:
Nov  3 12:46:48 host2 pure-ftpd[513715]: (?@103.176.152.25) [INFO] New connection from 103.176.152.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-03 12:48:52 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (caliment) [98.204.134.124]:32822: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-03 12:53:17 dovecot_plain authenticator failed for (unhels) [102.53.15.18]:34163: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.9
country_id: 290557
description:
2025-11-03 12:57:59 dovecot_login authenticator failed for (ADMIN) [217.138.162.9]:43312: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov  3 13:03:46 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, TLS: Connection closed, session=<gkFUvKtCWpenXpI6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-03 13:04:42 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:62530: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-11-03 13:04:46 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:57640: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.115
country_id: 294640
description:
2025-11-03 13:05:17 dovecot_login authenticator failed for ([195.133.156.115]) [195.133.156.115]:40072: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-03 13:06:28 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:58812: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-03 13:08:07 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:48052: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-11-03 13:08:37 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:32157: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:13:14 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<z+4r3qtCOsgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-11-03 13:14:05 dovecot_login authenticator failed for ([122.186.60.142]) [122.186.60.142]:60976: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:15:13 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<d19G5atCWp4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:17:09 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Pwko7KtCEJoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:17:11 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TA9R7KtC9OEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:19:07 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<eZc586tC4tQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:19:15 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<neqv86tCnrIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  3 13:21:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<PIz0+atCZtoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-03 13:24:42 dovecot_plain authenticator failed for (prene) [65.20.129.67]:53427: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov  3 13:26:00 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<v8XUC6xCRttChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.4
country_id: 3042058
description:
2025-11-03 13:26:46 dovecot_login authenticator failed for (ADMIN) [91.90.122.4]:46380: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Nov  3 13:32:52 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<gcNcJKxCapdBMQHo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Nov  3 13:33:15 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<x3HBJaxCMkRBMQHo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 13:33:37 host2 sshd[565707]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 13:39:13 host2 sshd[572334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.59
country_id: 6252001
description:
Nov  3 13:44:56 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AtCFT6xCzcnN0h87>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.173.219
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.173.219 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User cloudtourssrilan has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.49
country_id: 732800
description:
2025-11-03 13:54:26 dovecot_login authenticator failed for (ADMIN) [94.156.14.49]:38312: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-03 13:56:34 dovecot_plain authenticator failed for (phidit) [92.62.243.174]:48527: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-03 13:57:06 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:52074: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.78.112
country_id: 3017382
description:
2025-11-03 13:57:23 dovecot_login authenticator failed for 217-128-78-112.ftth.fr.orangecustomers.net [217.128.78.112]:57951: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-03 14:09:42 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (priman) [24.127.53.61]:55536: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.76.108.97
country_id: 953987
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 41.76.108.97 - bostonlanka "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.35
country_id: 6252001
description:
2025-11-03 14:26:34 dovecot_login authenticator failed for (ADMIN) [212.32.50.35]:48336: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Nov  3 14:35:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS: Connection closed, session=<zy7HA61C5NdChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.103
country_id: 298795
description:
2025-11-03 14:53:42 dovecot_login authenticator failed for (ADMIN) [188.213.34.103]:33492: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 15:06:46 host2 sshd[669501]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  3 15:19:48 host2 sshd[685743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.120
country_id: 6252001
description:
Nov  3 15:20:44 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.120, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7w8mpq1C+9LG6xh4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.241
country_id: 2750405
description:
2025-11-03 15:21:25 dovecot_login authenticator failed for (wKtZhwDrT) [178.16.54.241]:50664: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.171
country_id: 3144096
description:
2025-11-03 15:22:11 dovecot_login authenticator failed for (ADMIN) [46.246.122.171]:40084: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.241
country_id: 2750405
description:
2025-11-03 15:22:37 dovecot_login authenticator failed for (EnCirtm) [178.16.54.241]:64942: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov  3 15:23:03 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<+Btprq1Clf/CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.241
country_id: 2750405
description:
2025-11-03 15:23:22 dovecot_login authenticator failed for (8wqyCJrXK) [178.16.54.241]:57653: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 15:24:46 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<Sk2LtK1CvoJHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov  3 15:24:57 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<E6E9ta1CboZHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Nov  3 15:25:37 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.192, lip=66.85.158.91, session=<GHaht61CFOKTuYTA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  3 15:35:27 host2 sshd[705405]: Disconnected from invalid user brad 62.60.131.157 port 17832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.70
country_id: 2782113
description:
2025-11-03 15:53:47 dovecot_login authenticator failed for (ADMIN) [156.146.60.70]:34549: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-03 15:56:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52714: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.240.71
country_id: 6252001
description:
Nov  3 16:08:15 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.118.240.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GYgaUK5CYp0UdvBH>


