# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.124.76.248
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 70.124.76.248 - colourmar "GET /login/?login_only=1&user=colourmar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.233.58
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.243.233.58 - colourma "GET /login/?login_only=1&user=colourma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.187.144.147
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.187.144.147 - colourm "GET /login/?login_only=1&user=colourm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.200.218.116
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.200.218.116 - colour "GET /login/?login_only=1&user=colour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.12.41.224
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.12.41.224 - colo "GET /login/?login_only=1&user=colo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.107.133.137
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.107.133.137 - colourm2 "GET /login/?login_only=1&user=colourm2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.60.144.12
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.60.144.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.162.210.144
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.162.210.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.126.90.49
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.126.90.49 - colourmarkl "GET /login/?login_only=1&user=colourmarkl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.160.227.146
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.160.227.146 - colourmark "GET /login/?login_only=1&user=colourmark&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmark (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.7.65.166
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 69.7.65.166 - colou "GET /login/?login_only=1&user=colou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.27.61.250
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.27.61.250 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.30.89.45
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 98.30.89.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.112.41
country_id: 1819730
description:
Nov  5 19:43:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.112.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PqXUjtlCLvWlmnAp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.127.147.242
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.127.147.242 - colourmarkla "GET /login/?login_only=1&user=colourmarkla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.102.150.198
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 50.102.150.198 - colourm1 "GET /login/?login_only=1&user=colourm1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm1 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.46
country_id: 1819730
description:
Nov  5 19:44:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.46, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Z12vkNlCEsQtjpou>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.133.193.13
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.133.193.13 - colourmarklabels "GET /login/?login_only=1&user=colourmarklabels&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.126.100.216
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.126.100.216 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.117.199
country_id: 1819730
description:
Nov  5 19:44:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.117.199, lip=66.85.158.91, TLS, session=<HZ7SkNlCVhplJHXH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-05 19:48:35 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (supectae) [81.226.88.121]:36309: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-11-05 19:55:11 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:40262: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-11-05 19:55:31 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:51839: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-11-05 19:56:24 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:33619: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
country_id: 1269750
description:
2025-11-05 19:56:51 dovecot_login authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:34540: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 20:23:32 host2 sshd[266213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.102.134.12
country_id: 3077311
description:
Nov  5 20:24:57 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=176.102.134.12, lip=66.85.158.91, TLS, session=<EirRINpCrN2wZoYM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.227
country_id: 3175395
description:
Nov  5 20:25:15 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.68.178.227, lip=66.85.158.91, TLS, session=<grHhIdpCcdy5RLLj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.243
country_id: 6252001
description:
Nov  5 20:31:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=147.185.133.243, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VzMlOdpCT9yTuYXz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.243
country_id: 6252001
description:
Nov  5 20:32:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=147.185.133.243, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Ex1FPdpCYO+TuYXz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  5 20:34:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<CHewRdpCwN6LonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov  5 20:36:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS: Connection closed, session=<uVWSTNpCFK1ChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-05 20:37:01 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:33224: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.243
country_id: 6252001
description:
Nov  5 20:40:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.243, lip=66.85.158.91, TLS, session=<phBxWNpCVPqTuYXz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 20:44:56 host2 sshd[288461]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 20:55:51 host2 sshd[302061]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.244
country_id: 6252001
description:
Nov  5 21:05:12 host2 pure-ftpd[313987]: (?@205.210.31.244) [INFO] New connection from 205.210.31.244


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:11:47 host2 sshd[322088]: Disconnected from invalid user devuser 20.109.73.208 port 51646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:13:52 host2 sshd[324403]: Disconnected from invalid user ahsan 101.36.109.176 port 57240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.116
country_id: 6252001
description:
Nov  5 21:15:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MPvQ1dpCOZFBMQF0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov  5 21:14:30 host2 sshd[325047]: Disconnected from invalid user mario 119.92.70.82 port 54614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:14:56 host2 sshd[325429]: Disconnected from invalid user ubuntu 20.109.73.208 port 46806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Nov  5 21:15:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<317l1tpCYsNBMQFs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:15:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 26 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IL3G19pCjMGTuYRN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:16:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<h85429pClOeTuYRN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:17:13 host2 sshd[328005]: Disconnected from invalid user lzj 20.109.73.208 port 43636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov  5 21:19:14 host2 sshd[330175]: Disconnected from invalid user test 119.92.70.82 port 58024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:21:07 host2 sshd[332363]: Disconnected from invalid user admin 101.36.109.176 port 37480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov  5 21:22:18 host2 sshd[333595]: Disconnected from invalid user dev 119.92.70.82 port 60298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:22:33 host2 sshd[333820]: Disconnected from invalid user postgres 101.36.109.176 port 39138 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:24:00 host2 sshd[335114]: Disconnected from invalid user postgres 101.36.109.176 port 35018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 21:24:16 host2 sshd[335429]: Disconnected from invalid user elyse 62.60.131.157 port 26919 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.180.196.165
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 207.180.196.165 - jrdclk_water_test_user "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrdclk_water_test_user (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:23:38 host2 sshd[334850]: Disconnected from invalid user webuser 20.109.73.208 port 60530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:25:25 host2 sshd[336818]: Disconnected from invalid user hamza 101.36.109.176 port 44772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:24:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS, session=<RIkR99pCAveTuYRN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:25:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS, session=<BOVQ+tpCeuaTuYRN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:26:42 host2 sshd[338003]: Disconnected from invalid user pentaho 209.38.228.14 port 47338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.232
country_id: 3469034
description:
Nov  5 21:27:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=45.183.92.232, lip=66.85.158.91, TLS, session=<eFb//9pC+9gtt1zo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.102.137.15
country_id: 3077311
description:
Nov  5 21:27:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.102.137.15, lip=66.85.158.91, TLS, session=<w00tAdtCUIuwZokP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:29:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<NrzhB9tCiJ4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:29:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wp+GCdtCvNsDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:30:22 host2 sshd[341730]: Disconnected from invalid user headscale 209.38.228.14 port 47144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:31:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lm00D9tChMMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:32:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<eM3+FNtCitUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:35:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4i2XHNtCYIcDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:34:49 host2 sshd[346550]: Disconnected from invalid user esuser 209.38.228.14 port 50266 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:35:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+u+yHttC2r8DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:37:09 host2 sshd[349122]: Disconnected from invalid user cherry 209.38.228.14 port 32960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:36:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<c3FAIttCltwDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Nov  5 21:39:33 host2 sshd[351443]: Disconnected from invalid user bot2 181.104.58.194 port 54148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 21:41:51 host2 sshd[353768]: Disconnected from invalid user user 2.57.121.25 port 41919 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Nov  5 21:46:24 host2 sshd[371742]: Disconnected from invalid user ansadmin 181.104.58.194 port 45272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.104.58.194
country_id: 3865483
description:
Nov  5 21:48:07 host2 sshd[373600]: Disconnected from invalid user javier 181.104.58.194 port 50114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.80.204.149
country_id: 6252001
description:
Nov  5 21:50:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.80.204.149, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZON9VNtCMqYoUMyV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov  5 21:52:49 host2 sshd[378442]: Invalid user visionsolutionshospital from 154.219.110.64 port 49396


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 22:00:14 host2 sshd[387029]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.237.239.173
country_id: 3077311
description:
Nov  5 22:02:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=91.237.239.173, lip=66.85.158.91, TLS, session=<Qz6tfNtCU9Fb7e+t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.242.162
country_id: 1269750
description:
Nov  5 22:02:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=103.18.242.162, lip=66.85.158.91, TLS, session=<+4/vfdtCWdhnEvKi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 22:09:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 22:13:31 host2 sshd[400923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.174.131.247
country_id: 6252001
description:
Nov  5 22:25:42 host2 pure-ftpd[414716]: (?@54.174.131.247) [INFO] New connection from 54.174.131.247


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 22:29:15 host2 sshd[418959]: Disconnected from invalid user user 2.57.121.25 port 16459 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Nov  5 22:30:18 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.91, TLS, session=<ARcX4ttCHJpHBobp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.90
country_id: 6252001
description:
Nov  5 22:31:09 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.90, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GLgb5dtCspEUqWla>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 22:32:09 host2 sshd[422502]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-05 22:34:58 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:52180: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-05 22:35:26 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:53808: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:39:22 host2 sshd[430503]: Disconnected from invalid user sample 103.172.154.255 port 37226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.59
country_id: 1643084
description:
Nov  5 22:39:51 host2 sshd[431032]: Disconnected from invalid user mauro 103.186.1.59 port 41140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov  5 22:42:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<5OtoDNxCzt5ChJmA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov  5 22:42:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.92, session=<YYnbDNxCkq5APpxC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:42:19 host2 sshd[433869]: Disconnected from invalid user steam 103.172.154.255 port 36070 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov  5 22:42:42 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.92, session=<3OZsDtxCElNAPpxC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:43:03 host2 sshd[434553]: Disconnected from invalid user oracle 103.172.154.255 port 56520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:43:46 host2 sshd[435435]: Disconnected from invalid user hadoop 103.172.154.255 port 60712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:44:27 host2 sshd[436095]: Disconnected from invalid user yhx 138.99.80.102 port 58648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:44:41 host2 sshd[436316]: Disconnected from invalid user dipesh 103.218.240.181 port 34664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:46:13 host2 sshd[438423]: Disconnected from invalid user xy 103.218.240.181 port 53086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.59
country_id: 1643084
description:
Nov  5 22:45:37 host2 sshd[437836]: Disconnected from invalid user emo 103.186.1.59 port 42976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:47:33 host2 sshd[440168]: Disconnected from invalid user user 138.99.80.102 port 33300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:47:45 host2 sshd[440320]: Disconnected from invalid user john 103.218.240.181 port 33484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:50:54 host2 sshd[443657]: Disconnected from invalid user vncuser 103.218.240.181 port 45396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov  5 22:52:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, session=<JuVuMdxCaiRBMQEY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:52:35 host2 sshd[445506]: Disconnected from invalid user developer 103.218.240.181 port 38472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov  5 22:52:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS: Connection closed, session=<YnguMtxC9ohBMQEY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:55:07 host2 sshd[448830]: Disconnected from invalid user aaron 138.99.80.102 port 36228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 22:56:50 host2 sshd[450556]: Disconnected from invalid user ftpuser 202.70.82.95 port 8156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:57:57 host2 sshd[451789]: Disconnected from invalid user jirka 138.99.80.102 port 43098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 23:00:17 host2 sshd[454402]: Disconnected from invalid user tommy 202.70.82.95 port 51274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-05 23:00:36 dovecot_plain authenticator failed for (xybral) [65.20.155.223]:32922: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.200
country_id: 6252001
description:
Nov  5 23:05:01 host2 pure-ftpd[459566]: (?@205.210.31.200) [INFO] New connection from 205.210.31.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.161.157
country_id: 3865483
description:
2025-11-05 23:06:42 dovecot_login authenticator failed for (157.161.185.190.cable.dyn.ridsa.com.ar) [190.185.161.157]:49099: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.45.2.93
country_id: 3573591
description:
2025-11-05 23:07:06 dovecot_login authenticator failed for 186-45-2-93.dynamic.tstt.net.tt [186.45.2.93]:44187: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 23:09:46 host2 sshd[464535]: Disconnected from invalid user ftpuser 202.70.82.95 port 64064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov  5 23:11:36 host2 sshd[466561]: Disconnected from invalid user git 198.98.56.205 port 52114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-05 23:12:52 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:13660: 535 Incorrect authentication data (set_id=hr@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Nov  5 23:13:22 host2 sshd[468363]: Disconnected from invalid user hi 202.152.201.166 port 39824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 23:14:42 host2 sshd[469667]: Disconnected from invalid user nikola 202.70.82.95 port 51142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-11-05 23:15:50 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:48357: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.106.246
country_id: 6252001
description:
2025-11-05 23:16:04 dovecot_login authenticator failed for ([134.22.106.246]) [134.22.106.246]:52734: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:16:32 host2 sshd[471456]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.9.75.204
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.9.75.204 - topviewl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.152.201.166
country_id: 1643084
description:
Nov  5 23:18:26 host2 sshd[473507]: Disconnected from invalid user jramirez 202.152.201.166 port 54944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov  5 23:18:42 host2 sshd[473921]: Disconnected from invalid user ubuntu 198.98.56.205 port 60304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov  5 23:19:52 host2 sshd[475103]: Disconnected from invalid user rocky 198.98.56.205 port 44308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.195.226.17
country_id: 290557
description:
Nov  5 23:21:27 host2 sshd[476837]: Disconnected from invalid user jhernandez 5.195.226.17 port 19800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 23:20:49 host2 sshd[476182]: Disconnected from invalid user user 2.57.121.25 port 52981 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.195.226.17
country_id: 290557
description:
Nov  5 23:22:51 host2 sshd[478228]: Disconnected from invalid user dev 5.195.226.17 port 52740 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:24:58 host2 sshd[480203]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov  5 23:26:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nPvDqdxC6IRKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov  5 23:26:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS: Connection closed, session=<A+QmrNxCXLpKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  5 23:34:26 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, session=<Ib1zx9xClqxChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  5 23:34:33 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, session=<nkrUx9xCiKNChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.74
country_id: 6252001
description:
Nov  5 23:36:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.74, lip=66.85.158.92, session=<1zp4z9xCXaJBMQFK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Nov  5 23:36:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS: Connection closed, session=<Wi8+0NxCDDxBMQFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-05 23:38:10 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:59678: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-05 23:38:31 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:53108: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-05 23:40:07 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:50242: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-05 23:40:30 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:59684: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-11-05 23:42:06 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:55886: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Nov  5 23:43:10 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.91, TLS, session=<Jyit5txC2ujN0h/z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-05 23:43:17 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:43440: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  5 23:43:28 host2 pure-ftpd[499585]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  5 23:43:32 host2 pure-ftpd[499760]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-11-05 23:42:37 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:57250: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2025-11-05 23:42:41 dovecot_login authenticator failed for ([152.52.234.222]) [125.22.116.94]:38728: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  5 23:43:34 host2 pure-ftpd[499802]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov  5 23:44:33 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, session=<TBak69xCPo6s7OTF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.57
country_id: 6252001
description:
Nov  5 23:47:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.57, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CVzJ9txCE5NBMQE5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Nov  5 23:47:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nCfd99xC0ipBMQE0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.121.205.29
country_id: 3923057
description:
Nov  5 23:51:10 host2 sshd[508066]: Disconnected from invalid user prod 186.121.205.29 port 57604 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:50:53 host2 sshd[507771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  5 23:55:59 host2 sshd[514530]: Disconnected from invalid user utente 103.114.147.217 port 55012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:56:22 host2 sshd[514959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov  5 23:58:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XQOzHN1CLK+4aff+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Nov  5 23:58:28 host2 sshd[517106]: Disconnected from invalid user sammy 181.188.159.138 port 47742 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov  5 23:58:39 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<scsHHt1Col64aff+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  5 23:58:53 host2 sshd[517607]: Disconnected from invalid user ubuntu 103.114.147.217 port 42250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  6 00:00:15 host2 sshd[519160]: Disconnected from invalid user coco 103.114.147.217 port 52220 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.142.194
country_id: 2542007
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 105.155.142.194 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.83
country_id: 3175395
description:
Nov  6 00:00:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.208.189.83, lip=66.85.158.91, TLS, session=<m3A1Jd1CFd+50L1T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.17
country_id: 3865483
description:
Nov  6 00:01:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<info>, method=PLAIN, rip=190.181.90.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sYzIJt1COKa+tVoR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.64.32.144
country_id: 953987
description:
Nov  6 00:01:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=102.64.32.144, lip=66.85.158.91, TLS, session=<zHvQKN1C4N9mQCCQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.121.205.29
country_id: 3923057
description:
Nov  6 00:03:06 host2 sshd[522602]: Disconnected from invalid user sysadmin 186.121.205.29 port 56368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-06 00:04:11 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:52089: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.254.199
country_id: 1252634
description:
2025-11-06 00:04:35 dovecot_login authenticator failed for ([103.127.254.199]) [103.127.254.199]:41224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-06 00:04:48 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:46068: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-06 00:04:48 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:54088: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-06 00:05:02 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:57096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  6 00:05:46 host2 sshd[526068]: Disconnected from invalid user gerrit 103.114.147.217 port 57734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  6 00:07:09 host2 sshd[527602]: Disconnected from invalid user wangxin 103.114.147.217 port 41742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.121.205.29
country_id: 3923057
description:
Nov  6 00:10:45 host2 sshd[531220]: Disconnected from invalid user emma 186.121.205.29 port 54234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-06 00:11:25 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (taric) [68.60.77.128]:52780: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-11-06 00:19:00 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (pstees) [76.97.155.25]:35576: 535 Incorrect authentication data (set_id=news@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:20:28 host2 sshd[540673]: Disconnected from invalid user jlin 175.139.200.245 port 39497 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.214.41
country_id: 2921044
description:
Nov  6 00:19:34 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=164.90.214.41, lip=66.85.158.92, session=<WqXZaN1CkuakWtYp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:22:09 host2 sshd[542329]: Disconnected from invalid user VPN 175.139.200.245 port 55757 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-06 00:22:41 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (chiroarcer) [73.145.107.251]:34316: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:23:46 host2 sshd[543880]: Disconnected from invalid user ubuntu 175.139.200.245 port 43784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:25:20 host2 sshd[545589]: Disconnected from invalid user backuper 175.139.200.245 port 60044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 00:25:52 host2 sshd[546084]: Disconnected from invalid user elisha 62.60.131.157 port 19211 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.116.106.9
country_id: 798544
description:
Nov  6 00:26:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=195.116.106.9, lip=66.85.158.91, TLS, session=<vVM6gd1C+wrDdGoJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.236
country_id: 3175395
description:
Nov  6 00:26:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.189.236, lip=66.85.158.91, TLS, session=<CvRWgt1CJ6W50L3s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Nov  6 00:26:32 host2 sshd[546735]: Disconnected from invalid user kbe 181.188.159.138 port 53358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 00:27:58 host2 sshd[548040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:29:41 host2 sshd[549751]: Disconnected from invalid user admin 152.32.201.226 port 43658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:31:03 host2 sshd[551393]: Disconnected from invalid user dev 152.32.201.226 port 20888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-06 00:32:26 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:35054: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:32:30 host2 sshd[552657]: Disconnected from invalid user arif 152.32.201.226 port 53126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-06 00:32:37 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:38504: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Nov  6 00:34:13 host2 sshd[554290]: Disconnected from invalid user mattermost 181.188.159.138 port 37052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-06 00:34:21 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:35758: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.81.170.119
country_id: 4566966
description:
2025-11-06 00:34:30 dovecot_login authenticator failed for ([208.81.170.119]) [208.81.170.119]:13069: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:35:23 host2 sshd[555801]: Disconnected from invalid user cacti 152.32.201.226 port 62596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:34:36 host2 sshd[554806]: Disconnected from invalid user oracle 189.8.108.156 port 59166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-06 00:34:42 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:3556: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-06 00:34:49 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:59082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-06 00:34:54 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:35027: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
country_id: 99237
description:
2025-11-06 00:35:07 dovecot_login authenticator failed for ([65.20.204.164]) [65.20.204.164]:50427: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov  6 00:35:59 host2 sshd[556254]: Disconnected from invalid user pruebas 188.166.232.44 port 38006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:36:17 host2 sshd[556605]: Disconnected from invalid user ftpuser 189.8.108.156 port 56424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.232.44
country_id: 1880251
description:
Nov  6 00:39:19 host2 sshd[559681]: Disconnected from invalid user oracle 188.166.232.44 port 45664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:39:28 host2 sshd[559743]: Disconnected from invalid user bitnami 189.8.108.156 port 60880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:40:09 host2 sshd[560744]: Disconnected from invalid user dev 34.142.110.144 port 36744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.210
country_id: 6252001
description:
Nov  6 00:39:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</HI2sd1C9NbN0h/S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov  6 00:42:34 host2 sshd[562845]: Disconnected from invalid user ftpuser 188.166.232.44 port 53306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:42:57 host2 sshd[563220]: Disconnected from invalid user alf 189.8.108.156 port 58762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-06 00:45:01 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:45962: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-11-06 00:45:13 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:34809: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.49
country_id: 6252001
description:
Nov  6 00:45:53 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.49, lip=66.85.158.91, session=<XQH3xt1CauWTuYQx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-06 00:49:02 dovecot_plain authenticator failed for (buselymet) [87.200.171.25]:49010: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-06 00:49:07 dovecot_plain authenticator failed for (totary) [65.20.143.159]:58120: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:50:08 host2 sshd[570941]: Disconnected from invalid user retag 34.142.110.144 port 36486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:51:14 host2 sshd[572171]: Disconnected from invalid user student4 34.142.110.144 port 36774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:52:24 host2 sshd[573295]: Disconnected from invalid user dockeruser 34.142.110.144 port 37064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-06 00:59:20 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:55074: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-11-06 00:59:30 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:42267: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.170
country_id: 1269750
description:
2025-11-06 01:04:11 dovecot_login authenticator failed for (nsg-static-121.34.76.182-airtel.com) [182.78.93.170]:47878: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-06 01:04:23 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:46639: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-11-06 01:04:22 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:34944: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-06 01:03:59 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:50370: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-11-06 01:04:41 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:59460: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-11-06 01:04:55 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:56272: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov  6 01:07:48 host2 sshd[590972]: Disconnected from invalid user ubuntu 128.199.157.145 port 46984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Nov  6 01:09:08 host2 sshd[592266]: Disconnected from invalid user lch 128.199.157.145 port 47440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov  6 01:10:24 host2 sshd[593664]: Disconnected from invalid user admin 128.199.157.145 port 47898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.51.57
country_id: 1269750
description:
2025-11-06 01:13:00 dovecot_login authenticator failed for (broadband.actcorp.in) [183.83.51.57]:43894: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-11-06 01:13:13 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:36782: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.24
country_id: 6252001
description:
Nov  6 01:23:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.233.112.24, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sTLATt5Cir2H6XAY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.221
country_id: 6252001
description:
Nov  6 01:30:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nt3gZt5CLL4UQGnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 01:31:08 host2 sshd[614153]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-06 01:35:33 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:46400: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-06 01:35:47 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:55120: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Nov  6 01:37:55 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.91, session=<nAkGgd5CJDms7OTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 01:41:46 host2 sshd[624689]: Disconnected from invalid user moshe 62.60.131.157 port 45689 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 01:46:46 host2 sshd[630179]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-11-06 01:47:01 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (priant) [24.23.125.83]:37380: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Nov  6 01:54:02 host2 kernel: update_imunify[637646]: segfault at ffffffffff17e041 ip 00007fa69eb39a7d sp 00007fff2c27fea8 error 5 in memfd:upX (deleted)[7fa69eb39000+1000]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  6 01:55:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<+wjjwN5CuNdChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.150
country_id: 1269750
description:
2025-11-06 01:56:44 dovecot_login authenticator failed for (nsg-corporate-193.168.185.122.airtel.in) [125.19.163.150]:33080: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-11-06 01:57:22 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:48590: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-06 01:58:07 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:39042: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-11-06 01:58:41 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:52730: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-06 01:59:20 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:39391: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-06 01:59:37 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:60152: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:02:39 host2 sshd[647256]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.136
country_id: 6252001
description:
Nov  6 02:06:07 host2 pure-ftpd[651505]: (?@40.124.175.136) [INFO] New connection from 40.124.175.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-06 02:11:00 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:56309: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-06 02:11:35 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:49408: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.206.49
country_id: 6251999
description:
Nov  6 02:14:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.206.49, lip=66.85.158.92, session=<RjhcBd9CDsKUcc4x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.221
country_id: 3469034
description:
Nov  6 02:17:05 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.128.221, lip=66.85.158.91, TLS, session=<dC7zC99C1qa/NYDd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.48
country_id: 953987
description:
Nov  6 02:16:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.129.63.48, lip=66.85.158.91, TLS, session=<UH6bCt9CGJVmgT8w>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-06 02:20:13 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:52301: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-06 02:20:34 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:56000: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov  6 02:24:04 host2 sshd[670219]: Disconnected from invalid user ubuntu 198.98.57.141 port 43822 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:25:13 host2 sshd[671290]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-06 02:25:24 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:32516: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:26:04 host2 sshd[672276]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-06 02:26:06 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:39050: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-06 02:26:17 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:50985: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.68
country_id: 6252001
description:
Nov  6 02:26:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.68, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+nARLt9CE9nG6xhE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-06 02:26:26 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:34011: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Nov  6 02:25:47 host2 sshd[672069]: Disconnected from invalid user fox 198.98.57.141 port 45564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov  6 02:30:37 host2 sshd[676960]: Disconnected from invalid user ubuntu 198.98.57.141 port 50784 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.177.31.66
country_id: 3017382
description:
Nov  6 02:30:40 host2 sshd[676997]: Disconnected from invalid user ubuntu 164.177.31.66 port 33936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 02:39:07 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49578: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.161.146
country_id: 1269750
description:
2025-11-06 02:42:03 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.161.146]:39954: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-06 02:42:27 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:48048: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov  6 02:42:54 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, TLS, session=<VkJ0ad9CFL6UcdUX>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.109
country_id: 2635167
description:
Nov  6 02:43:20 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.109, lip=66.85.158.91, TLS, session=<gEj9at9CWcdX7LBt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Nov  6 02:43:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bWJGa99C4+m594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.104
country_id: 2635167
description:
Nov  6 02:43:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.104, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8txBbd9CZbFX7LBo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.95
country_id: 2635167
description:
Nov  6 02:44:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.95, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=</1I9b99C4ZFX7LBf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.88
country_id: 2635167
description:
Nov  6 02:45:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.88, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<ibg4cd9Cc9xX7LBY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Nov  6 02:46:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<frUtdd9CAc6594lS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Nov  6 02:45:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<uEg0c99CL5FX7LBM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Nov  6 02:46:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4egqd99CvYFX7LBd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.79
country_id: 2635167
description:
Nov  6 02:47:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.79, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<53ooed9CY7ZX7LBP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.84
country_id: 2635167
description:
Nov  6 02:48:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<yF0dfd9CI8ZX7LBU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.100
country_id: 2635167
description:
Nov  6 02:47:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.100, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<GO0he99C4a9X7LBk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.125.28
country_id: 798544
description:
Nov  6 02:50:18 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=84.234.125.28, lip=66.85.158.91, TLS, session=<wDHogt9ClZhU6n0c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.135
country_id: 2300660
description:
Nov  6 02:50:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.11.135, lip=66.85.158.91, TLS, session=<CH0lhN9CoNgpiwuH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  6 02:55:11 host2 pure-ftpd[703242]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  6 02:55:19 host2 pure-ftpd[703453]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Nov  6 02:57:15 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.236, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NpO/nN9C6d7G6xjs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:59:00 host2 sshd[707387]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 03:05:43 host2 sshd[715076]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.117
country_id: 6252001
description:
Nov  6 03:11:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.117, lip=66.85.158.92, TLS, session=<gYFjz99CRPbG6xh1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 03:12:13 host2 sshd[721908]: Disconnected from invalid user cali 62.60.131.157 port 46911 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-06 03:19:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ingly) [87.103.126.54]:6614: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.206.49
country_id: 6251999
description:
Nov  6 03:20:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.206.49, lip=66.85.158.91, session=<cnf57t9CwKaUcc4x>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.211
country_id: 6252001
description:
Nov  6 03:20:54 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.211, lip=66.85.158.92, session=<I2ZS8d9CAOHN0h/T>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov  6 03:22:50 host2 pure-ftpd[733711]: (?@205.210.31.241) [INFO] New connection from 205.210.31.241


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.126
country_id: 2635167
description:
Nov  6 03:24:26 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.126, lip=66.85.158.91, session=<eHD7/d9CMvgjy9J+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:31:18 host2 sshd[743353]: Disconnected from invalid user gameserver 20.102.70.34 port 41084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-11-06 03:33:15 dovecot_login authenticator failed for ([49.206.244.235]) [49.206.241.22]:8217: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-06 03:33:28 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:37449: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Nov  6 03:34:28 host2 sshd[746968]: Disconnected from invalid user work 182.18.139.237 port 57460 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 03:37:10 host2 sshd[750251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:38:05 host2 sshd[751339]: Disconnected from invalid user s1 20.102.70.34 port 52110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:39:29 host2 sshd[752740]: Disconnected from invalid user rmartinez 20.102.70.34 port 53486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:40:50 host2 sshd[754416]: Disconnected from invalid user sistemas 20.102.70.34 port 54834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.231
country_id: 130758
description:
Nov  6 03:43:16 host2 sshd[756761]: Disconnected from invalid user natali 185.50.38.231 port 56386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:44:22 host2 sshd[757822]: Disconnected from invalid user user 135.235.138.43 port 50890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:44:18 host2 sshd[757767]: Disconnected from invalid user sammy 152.32.172.146 port 38666 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.50.38.231
country_id: 130758
description:
Nov  6 03:46:31 host2 sshd[761409]: Disconnected from invalid user jenkins 185.50.38.231 port 44814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:46:11 host2 sshd[760905]: Disconnected from invalid user montse 152.32.172.146 port 45960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:47:32 host2 sshd[762560]: Disconnected from invalid user dms 135.235.138.43 port 60664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.231
country_id: 130758
description:
Nov  6 03:47:43 host2 sshd[762759]: Disconnected from invalid user caja01 185.50.38.231 port 33980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.195.4.162
country_id: 1819730
description:
Nov  6 03:47:46 host2 sshd[762853]: Disconnected from invalid user produccion 103.195.4.162 port 52032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:50:42 host2 sshd[766773]: Disconnected from invalid user natali 135.235.138.43 port 34620 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.195
country_id: 6252001
description:
Nov  6 03:51:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lxkbXeBCW83N0h/D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:51:20 host2 sshd[767605]: Disconnected from invalid user mamad 152.32.172.146 port 35274 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:52:26 host2 sshd[768928]: Disconnected from invalid user rooter 135.235.138.43 port 37932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:52:39 host2 sshd[769246]: Disconnected from invalid user produccion 152.32.172.146 port 35832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-06 03:56:20 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:33377: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.85
country_id: 6252001
description:
Nov  6 03:56:34 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=199.45.155.85, lip=66.85.158.92, session=<EbfrcOBCaO3HLZtV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-06 03:55:38 dovecot_login authenticator failed for ([37.57.69.227]) [37.57.69.227]:49479: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2025-11-06 03:55:32 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:40652: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-06 03:55:49 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:46918: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-06 03:56:04 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.77
country_id: 241170
description:
Nov  6 03:58:18 host2 sshd[777946]: Disconnected from invalid user li 154.91.170.77 port 41278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.195.4.162
country_id: 1819730
description:
Nov  6 03:58:28 host2 sshd[778190]: Disconnected from invalid user it 103.195.4.162 port 49566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov  6 03:58:56 host2 sshd[778733]: Disconnected from invalid user cps 20.253.214.172 port 38340 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.117
country_id: 6252001
description:
Nov  6 04:00:24 host2 pure-ftpd[780541]: (?@195.184.76.117) [INFO] New connection from 195.184.76.117


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:02:09 host2 sshd[782696]: Disconnected from invalid user ftpuser 103.174.215.18 port 60492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.195.4.162
country_id: 1819730
description:
Nov  6 04:02:45 host2 sshd[783582]: Disconnected from invalid user koko 103.195.4.162 port 37106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.77
country_id: 241170
description:
Nov  6 04:02:52 host2 sshd[783689]: Disconnected from invalid user steam 154.91.170.77 port 59152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov  6 04:04:19 host2 sshd[786078]: Disconnected from invalid user ahmad 20.253.214.172 port 60718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:03:40 host2 sshd[785163]: Disconnected from invalid user ubuntu 103.174.215.18 port 41860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov  6 04:05:56 host2 sshd[788078]: Disconnected from invalid user mahendra 20.253.214.172 port 43546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:07:49 host2 sshd[790398]: Disconnected from invalid user fff 103.174.215.18 port 39792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.77
country_id: 241170
description:
Nov  6 04:08:22 host2 sshd[791080]: Disconnected from invalid user jake 154.91.170.77 port 52156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-06 04:09:07 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:38582: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:09:10 host2 sshd[792062]: Disconnected from invalid user dmp 103.174.215.18 port 48402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-06 04:09:36 dovecot_login authenticator failed for ([65.20.155.223]) [65.20.155.223]:48706: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:11:05 host2 sshd[794797]: Disconnected from invalid user manuel 103.49.238.251 port 43240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:14:07 host2 sshd[798675]: Disconnected from invalid user victor 103.49.238.251 port 60320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:15:44 host2 sshd[801138]: Disconnected from invalid user sepehr 103.49.238.251 port 49420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:17:22 host2 sshd[803753]: Disconnected from invalid user life 103.49.238.251 port 57950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.162
country_id: 1733045
description:
2025-11-06 04:20:19 dovecot_login authenticator failed for ([49.124.154.162]) [49.124.154.162]:36582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-06 04:20:31 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:41421: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.98
country_id: 226074
description:
Nov  6 04:21:26 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=196.0.107.98, lip=66.85.158.91, TLS, session=<eU6kyOBC8+3EAGti>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.120
country_id: 3175395
description:
Nov  6 04:21:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.120, lip=66.85.158.91, TLS, session=<s2/dyeBC37erFut4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov  6 04:35:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.91, session=<xHxu+uBCjJyUcdUX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-11-06 04:36:50 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (cater) [73.137.7.97]:41556: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 04:39:55 host2 sshd[832826]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 04:44:16 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=51.222.152.150, lip=66.85.158.92, TLS, session=<7DmCG+FCHuMz3piW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.107
country_id: 6252001
description:
Nov  6 04:45:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.107, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AciiIeFCCNbN0h9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov  6 04:52:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=86.54.31.32, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YdzoOOFC0qhWNh8g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov  6 04:52:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.92, session=<sMwjOuFCvsqUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov  6 04:52:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=653) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.91, TLS: read(size=653) failed: Connection reset by peer, session=<nNsjOeFCmrJWNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-06 04:55:27 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:49286: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-11-06 04:55:28 dovecot_login authenticator failed for ([49.206.244.235]) [49.206.241.22]:6558: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-06 04:55:27 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:36832: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-06 04:55:49 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:33518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-06 04:55:54 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:37730: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-06 04:55:33 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:33407: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 04:55:50 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54951: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-06 05:03:39 dovecot_plain authenticator failed for (madiospier) [102.53.15.17]:44022: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 05:11:36 host2 sshd[862099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.213
country_id: 2300660
description:
Nov  6 05:11:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=41.139.37.213, lip=66.85.158.91, TLS, session=<d+EkfOFC5aEpiyXV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.130
country_id: 3865483
description:
Nov  6 05:11:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.124.218.130, lip=66.85.158.91, TLS, session=<889ffeFC7Jy6fNqC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-06 05:13:52 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:30599: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-06 05:13:52 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:47434: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-06 05:14:14 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:32266: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-06 05:14:36 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:33328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-06 05:33:59 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:50876: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-06 05:34:28 dovecot_login authenticator failed for ([50.235.31.47]) [50.235.31.47]:56146: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-06 05:34:40 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:44697: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-06 05:34:52 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:34708: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov  6 05:35:15 host2 sshd[883604]: Disconnected from invalid user unity 212.19.117.204 port 43223 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov  6 05:37:44 host2 sshd[885891]: Disconnected from invalid user install 212.19.117.204 port 36701 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Nov  6 05:37:24 host2 sshd[885626]: Disconnected from invalid user ry 27.254.185.64 port 17368 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.19.117.204
country_id: 3175395
description:
Nov  6 05:38:58 host2 sshd[886878]: Disconnected from invalid user erp 212.19.117.204 port 51274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Nov  6 05:42:36 host2 sshd[890120]: Disconnected from invalid user andi 27.254.185.64 port 9066 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov  6 05:42:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 17 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1RGt7OFCpoFChJmA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Nov  6 05:44:11 host2 sshd[891436]: Disconnected from invalid user raj 27.254.185.64 port 34882 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.115
country_id: 3017382
description:
Nov  6 05:50:18 host2 pure-ftpd[897463]: (?@91.196.152.115) [INFO] New connection from 91.196.152.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-06 05:53:54 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:49712: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-11-06 05:54:39 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:65016: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-06 05:58:34 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:60198: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-06 05:58:56 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:41174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-06 06:05:25 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (burry) [73.224.171.101]:50380: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.208.133.247
country_id: 6252001
description:
Nov  6 06:10:34 host2 sshd[916130]: Disconnected from invalid user user2 74.208.133.247 port 51198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 06:11:08 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59590: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.140.93.55
country_id: 6252001
description:
Nov  6 06:13:09 host2 sshd[918425]: Disconnected from invalid user kiran 166.140.93.55 port 53462 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:14:42 host2 sshd[919685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.208.133.247
country_id: 6252001
description:
Nov  6 06:18:45 host2 sshd[923658]: Disconnected from invalid user admin1 74.208.133.247 port 40440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.140.93.55
country_id: 6252001
description:
Nov  6 06:19:11 host2 sshd[924030]: Disconnected from invalid user postgres 166.140.93.55 port 60204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.140.93.55
country_id: 6252001
description:
Nov  6 06:20:39 host2 sshd[925293]: Disconnected from invalid user runner 166.140.93.55 port 33640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 06:21:23 host2 sshd[925959]: Disconnected from invalid user user 2.57.121.25 port 34348 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:25:52 host2 sshd[929736]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-06 06:31:21 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (drifachen) [98.227.25.115]:32858: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:34:54 host2 sshd[937883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-06 06:34:46 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:49922: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-06 06:34:48 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:52593: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-11-06 06:34:56 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:57741: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-06 06:34:21 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:58260: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-06 06:34:24 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:60288: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.43.167
country_id: 2750405
description:
Nov  6 06:40:50 host2 sshd[944015]: Disconnected from invalid user yuki 167.172.43.167 port 57026 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:46:09 host2 sshd[949353]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.43.167
country_id: 2750405
description:
Nov  6 06:49:31 host2 sshd[952150]: Disconnected from invalid user wyy 167.172.43.167 port 33550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.218.243
country_id: 1643084
description:
Nov  6 06:53:26 host2 sshd[955932]: Disconnected from invalid user sysadmin 103.179.218.243 port 51392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.218.243
country_id: 1643084
description:
Nov  6 06:54:20 host2 sshd[957046]: Disconnected from invalid user jupyter 103.179.218.243 port 51474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.225
country_id: 3469034
description:
Nov  6 06:54:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=191.53.130.225, lip=66.85.158.91, TLS, session=<nbyc7OJC+Na/NYLh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.95
country_id: 3865483
description:
Nov  6 06:55:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.1.224.95, lip=66.85.158.91, TLS, session=</xn+7eJCoZm6AeBf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.218.243
country_id: 1643084
description:
Nov  6 06:55:03 host2 sshd[957843]: Disconnected from invalid user leonardo 103.179.218.243 port 51546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 06:57:07 host2 sshd[959867]: Disconnected from invalid user omer 103.172.112.192 port 33912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Nov  6 06:56:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<GtAF9OJC2uOnXpIx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:57:14 host2 sshd[959940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.5.112.39
country_id: 3175395
description:
Nov  6 06:59:45 host2 sshd[961958]: Disconnected from invalid user azureuser 151.5.112.39 port 48654 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:01:05 host2 sshd[963359]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 07:01:35 host2 sshd[963936]: Disconnected from invalid user minni 103.172.112.192 port 52064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 07:01:39 host2 sshd[964021]: Disconnected from invalid user jolie 62.60.131.157 port 51243 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.72.165
country_id: 1819730
description:
Nov  6 07:01:46 host2 sshd[964117]: Disconnected from invalid user omm 103.143.72.165 port 34764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-06 07:01:53 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (humpsal) [24.127.53.61]:52464: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Nov  6 07:02:39 host2 sshd[964977]: Disconnected from invalid user laci 186.96.151.198 port 40696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.5.112.39
country_id: 3175395
description:
Nov  6 07:04:11 host2 sshd[966641]: Disconnected from invalid user gcs 151.5.112.39 port 56456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 07:03:12 host2 sshd[965830]: Disconnected from invalid user postgresql 103.172.112.192 port 57776 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 151.5.112.39
country_id: 3175395
description:
Nov  6 07:03:23 host2 sshd[966019]: Received disconnect from 151.5.112.39 port 45740:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov  6 07:06:16 host2 sshd[968652]: Disconnected from invalid user roberta 186.96.151.198 port 42844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov  6 07:06:52 host2 sshd[969341]: Disconnected from invalid user antonio 58.147.171.11 port 32652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.147.171.11
country_id: 1210997
description:
Nov  6 07:08:18 host2 sshd[970603]: Disconnected from invalid user arkserver 58.147.171.11 port 61730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 07:09:28 host2 sshd[971620]: Disconnected from invalid user prakash 103.172.112.192 port 35102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov  6 07:10:01 host2 sshd[972099]: Disconnected from invalid user ubuntu 186.96.151.198 port 44996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov  6 07:11:10 host2 sshd[973286]: Disconnected from invalid user admin 58.147.171.11 port 63372 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:11:31 host2 sshd[973721]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.72.165
country_id: 1819730
description:
Nov  6 07:13:39 host2 sshd[975819]: Disconnected from invalid user fivem 103.143.72.165 port 58664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.72.165
country_id: 1819730
description:
Nov  6 07:16:59 host2 sshd[978817]: Disconnected from invalid user crypto 103.143.72.165 port 60502 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:19:21 host2 sshd[981017]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-06 07:19:27 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:37524: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-11-06 07:19:51 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:53446: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.126
country_id: 2264397
description:
Nov  6 07:24:40 host2 pure-ftpd[985807]: (?@45.156.129.126) [INFO] New connection from 45.156.129.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-06 07:27:14 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:55050: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-11-06 07:27:33 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:35254: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-06 07:28:24 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:36969: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-06 07:28:40 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:52371: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-06 07:32:15 dovecot_plain authenticator failed for (antifinis) [65.20.205.197]:33741: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.237.191
country_id: 3508796
description:
Nov  6 07:40:54 host2 sshd[1001005]: Disconnected from invalid user vhserver 190.167.237.191 port 49256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov  6 07:43:26 host2 sshd[1003383]: Disconnected from invalid user rohit 190.167.237.191 port 34806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 07:43:36 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:51890: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.149
country_id: 690791
description:
Nov  6 07:43:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=37.221.147.149, lip=66.85.158.91, TLS, session=<19glnONC15sl3ZOV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.11.95.97
country_id: 798544
description:
Nov  6 07:44:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=78.11.95.97, lip=66.85.158.91, TLS, session=<tRk2neNCL+tOC19h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 07:44:10 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:55746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:49:17 host2 sshd[1009503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-06 07:57:03 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:52929: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-11-06 07:57:25 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:55090: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-06 07:57:24 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:49631: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-06 07:57:42 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:34920: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-06 08:10:41 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:49732: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-06 08:10:24 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:41607: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2025-11-06 08:14:23 dovecot_login authenticator failed for (abts-tn-static-181.6.185.136.airtelbroadband.in) [136.185.6.181]:44465: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.237.243.62
country_id: 192950
description:
2025-11-06 08:14:08 dovecot_login authenticator failed for (197.237.243.62.wananchi.com) [197.237.243.62]:52765: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 08:16:36 host2 sshd[1037498]: Disconnected from invalid user asa 62.60.131.157 port 27029 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.40
country_id: 6252001
description:
Nov  6 08:19:44 host2 pure-ftpd[1040398]: (?@198.235.24.40) [INFO] New connection from 198.235.24.40


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 08:20:46 host2 sshd[1041426]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.104.17
country_id: 3469034
description:
Nov  6 08:28:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=187.85.104.17, lip=66.85.158.91, TLS, session=<riMtPeRCyry7VWgR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.237.119
country_id: 99237
description:
Nov  6 08:29:03 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.237.119, lip=66.85.158.91, TLS, session=<mXVXPuRCfYtBFO13>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 08:40:39 host2 sshd[1060470]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-11-06 08:44:11 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (assly) [68.38.201.238]:45446: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 08:46:48 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:39380: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-06 08:46:07 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:47752: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.171.97
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.171.97 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User cloudtourssrilan has their account suspended. Login blocked.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.79.29.108
country_id: 1831722
description:
Nov  6 09:01:43 host2 sshd[1081526]: Disconnected from invalid user odoo11 202.79.29.108 port 60010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Nov  6 09:04:43 host2 sshd[1084537]: Disconnected from invalid user ec2-user 202.79.29.108 port 34834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-11-06 09:06:28 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net (ovuloic) [73.45.216.101]:40814: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.241.103
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 74.105.241.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.79
country_id: 1880251
description:
Nov  6 09:10:37 host2 sshd[1090698]: Disconnected from invalid user odoo11 45.78.193.79 port 60154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 09:21:16 host2 sshd[1101224]: Disconnected from invalid user bernard 62.60.131.157 port 38774 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 09:21:49 host2 sshd[1101853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 09:23:53 host2 sshd[1103858]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.79
country_id: 1880251
description:
Nov  6 09:25:45 host2 sshd[1105725]: Disconnected from invalid user user 45.78.193.79 port 55030 [preauth]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.134.169.106
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.169.106 - cloudtourssrilan "POST /cpsess4606104971/json-api/cpanel HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [101.2.176.13] != Current IP Address [112.134.169.106]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.79
country_id: 1880251
description:
Nov  6 09:33:24 host2 sshd[1112686]: Disconnected from invalid user max 45.78.193.79 port 59836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 09:39:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59044: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.10
country_id: 6252001
description:
Nov  6 09:41:04 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.10, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IWL0QOVCqdnG6xgK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  6 09:44:04 host2 pure-ftpd[1123193]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  6 09:44:07 host2 pure-ftpd[1123269]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  6 09:44:09 host2 pure-ftpd[1123299]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  6 09:48:17 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.204, lip=66.85.158.92, session=<JfW6WuVCILmUcdbM>


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 112.134.169.106
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.169.106 NEW cloudtourssrilan:Yx6p4hokCT7y3K_t address=112.134.169.106,app=cpaneld,creator=cloudtourssrilan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-06 09:51:28 dovecot_plain authenticator failed for (ditubil) [65.20.147.45]:50336: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-11-06 09:59:14 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:37760: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-06 09:59:43 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:57807: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.78
country_id: 6252001
description:
Nov  6 10:00:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.228.53.78, lip=66.85.158.91, TLS, session=<goBIheVCQsdC5DVO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.11.95.227
country_id: 798544
description:
Nov  6 10:02:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=78.11.95.227, lip=66.85.158.91, TLS, session=<T9U3jOVCtrpOC1/j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.229
country_id: 3175395
description:
Nov  6 10:02:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.188.229, lip=66.85.158.91, TLS, session=<VjhJjeVCKJ+50Lzl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-06 10:05:47 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:43110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Nov  6 10:05:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<px1pmeVCUKstT3OG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-11-06 10:05:17 dovecot_login authenticator failed for ([49.206.244.235]) [49.206.241.22]:36832: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:06:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4Io5neVCo9Ijy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:07:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<78dWoOVCrOsjy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  6 10:08:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OolDpOVCLInUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:08:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<HCTLoeVCqOYjy9JO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 10:09:15 host2 sshd[1150902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-06 10:10:32 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:60170: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-06 10:10:56 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:36020: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.204.7
country_id: 6251999
description:
Nov  6 10:13:06 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=68.183.204.7, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IRl1s+VCstlEt8wH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.204.7
country_id: 6251999
description:
Nov  6 10:13:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=68.183.204.7, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<C8aGs+VC9tlEt8wH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:14:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS, session=<kujituVCNuQjy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:15:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS, session=<rvd8uuVCEvEjy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:15:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS, session=<pNa+uuVCgOgjy9JO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Nov  6 10:15:57 host2 pure-ftpd[1157507]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.177.19
country_id: 2782113
description:
Nov  6 10:15:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.177.19, lip=66.85.158.91, session=<Bf6xveVC6K258rET>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-06 10:22:20 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:47578: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-06 10:22:37 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:34906: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.40.247
country_id: 6252001
description:
2025-11-06 10:24:59 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:56117: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.74
country_id: 3865483
description:
Nov  6 10:25:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=181.225.195.74, lip=66.85.158.91, TLS, session=<9FZc4OVCOrS14cNK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-06 10:25:26 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:51402: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.230
country_id: 953987
description:
Nov  6 10:25:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.64.42.230, lip=66.85.158.91, TLS, session=<rJUQ3+VCqpZmQCrm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-06 10:30:42 dovecot_plain authenticator failed for (euling) [46.8.245.34]:44102: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov  6 10:32:20 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.91, TLS, session=<mPZB+OVCcEms7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-06 10:35:46 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:54766: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-06 10:36:10 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:48142: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 10:42:43 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57212: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-06 10:43:17 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:45784: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 10:54:11 host2 sshd[1197462]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:13:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+IbkiuZCgPKTuYSV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:14:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=</v7XjeZCoPWTuYSV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-06 11:14:47 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:51581: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-06 11:15:00 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:41759: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov  6 11:16:37 host2 sshd[1221460]: Disconnected from invalid user localhost 45.81.23.80 port 50472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:18:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS, session=<rc/9nOZCBPOTuYSV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov  6 11:19:48 host2 sshd[1224771]: Disconnected from invalid user public 45.81.23.80 port 57790 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:19:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS, session=<OeKQouZCHumTuYSV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.80
country_id: 2750405
description:
Nov  6 11:20:55 host2 sshd[1225883]: Disconnected from invalid user panel 45.81.23.80 port 57016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-06 11:24:16 dovecot_plain authenticator failed for (buming) [88.207.210.23]:59350: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:28:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<qXc7wOZCxIkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:29:41 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<nxBixeZCDpMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:30:28 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<i28nyOZCss4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:31:42 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<EmOUzOZCnLgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:33:04 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<UXp/0eZCirADhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:33:52 host2 dovecot[3154217]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<vapa1OZC1qoDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 11:34:34 host2 sshd[1239794]: Disconnected from invalid user user 2.57.121.25 port 34610 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Nov  6 11:34:39 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<Wj8c1+ZC3runXpI+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:35:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<XH2V2OZChI8DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:35:19 host2 dovecot[3154217]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ToOG2eZCLM8DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-06 11:36:15 dovecot_plain authenticator failed for (forip) [65.20.147.45]:49037: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:36:39 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<rEVQ3uZCYqsDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.94
country_id: 1880251
description:
Nov  6 11:40:03 host2 sshd[1245319]: Disconnected from invalid user ftp_client 101.47.162.94 port 35972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.64.244.15
country_id: 690791
description:
Nov  6 11:42:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=195.64.244.15, lip=66.85.158.91, TLS, session=<WhBW8+ZCDYnDQPQP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.42
country_id: 3175395
description:
Nov  6 11:43:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.42, lip=66.85.158.91, TLS, session=<Tzts9OZCOb65D6sq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-06 11:46:25 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:39307: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-11-06 11:47:21 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:33348: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.61.163
country_id: 1269750
description:
2025-11-06 11:54:55 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.61.163]:2212: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-11-06 11:55:16 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:50983: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-06 11:58:09 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:45101: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-06 11:58:28 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:33926: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 12:04:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.92, session=<l5eUQOdCvJoz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:05:36 host2 sshd[1273013]: Disconnected from invalid user mailuser 103.84.119.130 port 40018 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 12:05:54 host2 pure-ftpd[1273349]: (?@51.222.152.150) [INFO] New connection from 51.222.152.150


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 12:05:59 host2 pure-ftpd[1273454]: (?@51.222.152.150) [INFO] New connection from 51.222.152.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-11-06 12:06:31 dovecot_login authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:55346: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-06 12:07:28 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:44341: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.235.217
country_id: 2921044
description:
Nov  6 12:08:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.235.217, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<V9zKT+dC4c+kXOvZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.22.160
country_id: 2921044
description:
Nov  6 12:08:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.22.22.160, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zFDmUedC0q+lFhag>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:09:53 host2 sshd[1277371]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:09:18 host2 sshd[1276812]: Disconnected from invalid user ftptest 103.84.119.130 port 37734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:10:41 host2 sshd[1278388]: Disconnected from invalid user vps 103.84.119.130 port 43044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:11:31 host2 sshd[1279089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:12:02 host2 sshd[1279654]: Disconnected from invalid user billing 103.84.119.130 port 41122 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Nov  6 12:13:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.248, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<To7GYOdC9MvG6xj4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-11-06 12:13:12 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:47898: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov  6 12:14:07 host2 sshd[1282205]: Disconnected from invalid user ts1 162.241.127.152 port 42026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.109.200.147
country_id: 130758
description:
Nov  6 12:16:09 host2 sshd[1284426]: Disconnected from invalid user artur 78.109.200.147 port 48642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-06 12:18:30 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:48720: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.139.140.231
country_id: 1168579
description:
2025-11-06 12:18:53 dovecot_login authenticator failed for ([103.139.140.231]) [103.139.140.231]:42619: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.233.247.114
country_id: 298795
description:
2025-11-06 12:18:59 dovecot_plain authenticator failed for ([89.116.164.85]) [185.233.247.114]:46496: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.108.213.123
country_id: 3469034
description:
2025-11-06 12:19:13 dovecot_plain authenticator failed for ([89.116.164.85]) [179.108.213.123]:56280: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.20.116.193
country_id: 3469034
description:
2025-11-06 12:19:28 dovecot_plain authenticator failed for ([89.116.164.85]) [187.20.116.193]:52234: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov  6 12:19:39 host2 sshd[1288192]: Disconnected from invalid user user5 103.137.194.125 port 59912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov  6 12:19:42 host2 sshd[1288270]: Disconnected from invalid user artur 162.241.127.152 port 43680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:23:30 host2 sshd[1292501]: Disconnected from invalid user adminuser 47.180.114.229 port 58794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Nov  6 12:23:31 host2 sshd[1292499]: Disconnected from invalid user tol 78.109.200.147 port 35742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.137.194.125
country_id: 1269750
description:
Nov  6 12:24:37 host2 sshd[1293644]: Disconnected from invalid user miki 103.137.194.125 port 48574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:25:54 host2 sshd[1294912]: Disconnected from invalid user kapil 47.180.114.229 port 60878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:27:11 host2 sshd[1296304]: Disconnected from invalid user sftpuser 47.180.114.229 port 33696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:28:26 host2 sshd[1297407]: Disconnected from invalid user alf 47.180.114.229 port 34738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov  6 12:29:29 host2 sshd[1298335]: Disconnected from invalid user aiya 103.137.194.125 port 40230 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:29:43 host2 sshd[1298581]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.99.27.79
country_id: 1643084
description:
Nov  6 12:33:43 host2 sshd[1302657]: Invalid user info@idesignvector.com from 103.99.27.79 port 52350


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.99.27.79
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.99.27.79 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.48.61
country_id: 2921044
description:
Nov  6 12:37:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.71.48.61, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<G3cttudCYaOnRzA9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.136.29
country_id: 2921044
description:
Nov  6 12:37:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=139.59.136.29, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9GVKuOdC9kmLO4gd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Nov  6 12:37:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.64, lip=66.85.158.92, TLS, session=<yD+/uOdCtOmTuYRA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.48.61
country_id: 2921044
description:
Nov  6 12:37:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=167.71.48.61, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<d3SUtudClSunRzA9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.89.168.4
country_id: 3175395
description:
Nov  6 12:45:24 host2 sshd[1314346]: Disconnected from invalid user vhserver 152.89.168.4 port 51902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.89.168.4
country_id: 3175395
description:
Nov  6 12:46:45 host2 sshd[1315482]: Disconnected from invalid user noreply 152.89.168.4 port 47150 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:48:04 host2 sshd[1316731]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-11-06 12:50:42 dovecot_login authenticator failed for (70-89-116.5-busname-wa.hfc.comcastbusiness.net) [70.89.116.5]:58105: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.89.168.4
country_id: 3175395
description:
Nov  6 12:51:47 host2 sshd[1320573]: Disconnected from invalid user developer 152.89.168.4 port 48064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-11-06 12:51:11 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:36278: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-06 12:51:43 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:2693: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.159.230
country_id: 1512440
description:
Nov  6 12:53:01 host2 sshd[1321857]: Disconnected from invalid user elp 45.138.159.230 port 59156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.154.74.33
country_id: 6252001
description:
2025-11-06 12:54:07 dovecot_plain authenticator failed for c-73-154-74-33.hsd1.wv.comcast.net ([89.116.164.85]) [73.154.74.33]:50048: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.82
country_id: 6252001
description:
Nov  6 13:01:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.82, lip=66.85.158.92, session=<T6NlDuhCaJKsynZS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 13:02:29 host2 sshd[1331892]: Disconnected from invalid user darnell 62.60.131.157 port 26846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.159.230
country_id: 1512440
description:
Nov  6 13:02:31 host2 sshd[1331897]: Disconnected from invalid user sonarqube 45.138.159.230 port 45424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.159.230
country_id: 1512440
description:
Nov  6 13:05:08 host2 sshd[1334907]: Disconnected from invalid user admin 45.138.159.230 port 48848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov  6 13:05:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<GzOzHehCnMinXpI1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Nov  6 13:12:02 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.91, session=<9exqM+hC8M+l4z73>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 13:11:58 host2 sshd[1341339]: Disconnected from invalid user darnell 62.60.131.157 port 63979 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 13:15:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64237: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.206.110
country_id: 130758
description:
Nov  6 13:16:37 host2 sshd[1345626]: Disconnected from invalid user tempuser 85.133.206.110 port 42440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 13:16:55 host2 sshd[1345891]: Disconnected from invalid user user 2.57.121.25 port 30250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.206.110
country_id: 130758
description:
Nov  6 13:26:44 host2 sshd[1354585]: Disconnected from invalid user ftpuser 85.133.206.110 port 54978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.186
country_id: 1733045
description:
2025-11-06 13:28:26 dovecot_login authenticator failed for ([49.124.148.186]) [49.124.148.186]:34642: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-06 13:27:56 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:41324: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.68.212
country_id: 6252001
description:
Nov  6 13:28:46 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=159.203.68.212, lip=66.85.158.92, TLS, session=<VWNDb+hC7oGfy0TU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 13:33:37 host2 sshd[1361224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.124
country_id: 3175395
description:
Nov  6 13:34:25 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.124, lip=66.85.158.91, TLS, session=<fO5zguhC4pW5D6l8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.213
country_id: 3865483
description:
Nov  6 13:34:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=181.191.223.213, lip=66.85.158.91, TLS, session=<wblHgehCNtC1v9/V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.124.222
country_id: 6252001
description:
Nov  6 13:37:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.124.222, lip=66.85.158.91, session=<X8UBj+hCwtQNWXze>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-06 13:38:06 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (denterp) [73.196.144.25]:46932: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-06 13:40:14 dovecot_plain authenticator failed for (cromeles) [65.20.251.71]:55549: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.195.83.210
country_id: 1269750
description:
Nov  6 13:44:46 host2 sshd[1371901]: Disconnected from invalid user user4 14.195.83.210 port 8259 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Nov  6 13:49:40 host2 sshd[1376824]: Disconnected from invalid user asterisk 14.195.83.210 port 29821 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-11-06 13:56:14 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:49388: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.160.146
country_id: 3469034
description:
2025-11-06 13:56:42 dovecot_login authenticator failed for ([191.59.160.146]) [191.59.160.146]:36400: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.134
country_id: 1269750
description:
Nov  6 14:02:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.18.166.134, lip=66.85.158.91, TLS, session=<EDm85ehCZ6FnEqaG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.78
country_id: 798544
description:
Nov  6 14:02:32 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.244.78, lip=66.85.158.91, TLS, session=<y4oA5+hCN7NtffRO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-11-06 14:04:58 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:39170: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-06 14:05:24 dovecot_login authenticator failed for ([125.20.249.192]) [27.123.113.10]:60060: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-06 14:05:42 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:35247: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-06 14:05:53 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:59000: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-06 14:08:02 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:40094: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-06 14:08:11 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:46554: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-06 14:08:28 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:34723: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-06 14:07:51 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:54612: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.2.4.105
country_id: 1819730
description:
Nov  6 14:09:10 host2 sshd[1399494]: Disconnected from invalid user ubuntu 20.2.4.105 port 49872 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.231
country_id: 6252001
description:
Nov  6 14:09:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KindAelCUtTG6xjn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov  6 14:11:07 host2 sshd[1401898]: Disconnected from invalid user hadi 172.245.92.99 port 55778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov  6 14:12:19 host2 sshd[1403028]: Disconnected from invalid user elasticsearch 172.245.92.99 port 42216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-06 14:12:34 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (pharauman) [98.40.101.10]:38322: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 14:15:32 host2 sshd[1406100]: Disconnected from invalid user izaiah 62.60.131.157 port 19359 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.99
country_id: 6252001
description:
Nov  6 14:15:50 host2 sshd[1406402]: Disconnected from invalid user zhouhao 172.245.92.99 port 50212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov  6 14:18:05 host2 sshd[1408691]: Disconnected from invalid user amax 62.97.44.51 port 47362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.207.196.26
country_id: 130758
description:
Nov  6 14:18:42 host2 sshd[1409373]: Disconnected from invalid user admin 213.207.196.26 port 47074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.207.196.26
country_id: 130758
description:
Nov  6 14:21:07 host2 sshd[1411987]: Disconnected from invalid user kali 213.207.196.26 port 47788 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.207.196.26
country_id: 130758
description:
Nov  6 14:22:25 host2 sshd[1413356]: Disconnected from invalid user guest 213.207.196.26 port 33902 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 14:24:51 host2 sshd[1415644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Nov  6 14:28:45 host2 sshd[1419486]: Disconnected from invalid user rich 62.97.44.51 port 58874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.2.4.105
country_id: 1819730
description:
Nov  6 14:31:19 host2 sshd[1421837]: Disconnected from invalid user centos 20.2.4.105 port 53888 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Nov  6 14:35:11 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.92, session=<ATvKXOlCnIul4z73>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-06 14:40:31 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:45887: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.177.212
country_id: 6252001
description:
Nov  6 14:41:25 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.177.212, lip=66.85.158.92, session=<sKsTc+lC8OAUQbHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 14:45:29 host2 sshd[1435292]: Disconnected from invalid user user 2.57.121.25 port 42886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.205.126
country_id: 3175395
description:
Nov  6 14:57:53 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.70.205.126, lip=66.85.158.91, TLS, session=<NIv1rOlCldVtRs1+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.171
country_id: 6252001
description:
Nov  6 14:57:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.171, lip=66.85.158.91, session=<GdwnrulCBssofK2r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-06 14:58:05 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:54640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.42
country_id: 3865483
description:
Nov  6 14:58:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.96.193.42, lip=66.85.158.91, TLS, session=<e1gerulCG866YMEq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-06 14:57:34 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3008: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.67.28.239
country_id: 1643084
description:
2025-11-06 14:58:56 dovecot_login authenticator failed for ([36.67.28.239]) [36.67.28.239]:6731: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-11-06 14:59:14 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:47665: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.92
country_id: 6252001
description:
Nov  6 15:00:54 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.92, lip=66.85.158.91, TLS, session=<tWfCuOlCivfN0h9c>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.98.152.158
country_id: 6252001
description:
Nov  6 15:03:05 host2 pure-ftpd[1452032]: (?@20.98.152.158) [INFO] New connection from 20.98.152.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-06 15:05:53 dovecot_plain authenticator failed for (ingoms) [12.150.243.22]:18815: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 15:10:10 host2 sshd[1458652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.163.10.186
country_id: 6252001
description:
Nov  6 15:11:13 host2 pure-ftpd[1459711]: (?@20.163.10.186) [INFO] New connection from 20.163.10.186


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Nov  6 15:14:21 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<fj3b6OlCgpBHBobn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Nov  6 15:24:10 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<rmjsC+pCBrqnXpI0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov  6 15:24:21 host2 pure-ftpd[1471892]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 15:28:03 host2 sshd[1478013]: Disconnected from invalid user annalise 62.60.131.157 port 19617 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.210.69.245
country_id: 3865483
description:
Nov  6 15:28:57 host2 sshd[1479456]: Disconnected from invalid user rupesh 190.210.69.245 port 58318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.90
country_id: 6252001
description:
Nov  6 15:31:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.90, lip=66.85.158.92, TLS handshaking: Connection closed, session=<D6UHJupCVsEs3Lxa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.90
country_id: 6252001
description:
Nov  6 15:31:33 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=44.220.188.90, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<T+pVJupCPLIs3Lxa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.210.69.245
country_id: 3865483
description:
Nov  6 15:32:12 host2 sshd[1483877]: Disconnected from invalid user noc 190.210.69.245 port 41124 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.115.112
country_id: 6251999
description:
Nov  6 15:34:51 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.89.115.112, lip=66.85.158.91, TLS, session=<BcwmMupCXLmfWXNw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.210.69.245
country_id: 3865483
description:
Nov  6 15:35:46 host2 sshd[1489022]: Disconnected from invalid user db2fenc1 190.210.69.245 port 52166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 15:37:17 host2 sshd[1491075]: Disconnected from invalid user annalise 62.60.131.157 port 27991 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.168
country_id: 6252001
description:
Nov  6 15:38:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.168, lip=66.85.158.92, session=<Us6bP+pCMqQs3Lmo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-06 15:39:37 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:55183: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-11-06 15:40:23 dovecot_login authenticator failed for host-95-229-5-248.business.telecomitalia.it [95.229.5.248]:40266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-06 15:40:33 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:47962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 16:01:21 host2 sshd[1520384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-06 16:06:23 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:33701: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-06 16:06:37 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:52883: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  6 16:07:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<hFPgpupCQLZChJl+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  6 16:07:31 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS, session=<GyH7pupC0sxChJl+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.135.131
country_id: 6252001
description:
Nov  6 16:12:06 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<WUdYt+pCWN9HBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Nov  6 16:12:06 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<m1Bat+pCxuFHBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Nov  6 16:25:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, TLS: Connection closed, session=<y1lj5upCIMHLN4MD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 16:25:59 host2 sshd[1544765]: Disconnected from invalid user user 2.57.121.25 port 34704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  6 16:26:57 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, session=<dvF+7OpCnaktKyHS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.12.70.143
country_id: 690791
description:
Nov  6 16:27:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=194.12.70.143, lip=66.85.158.91, TLS, session=<x2Vn7OpCHeXCDEaP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  6 16:27:28 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, session=<4D9V7upCT5YtKyHS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.32.114
country_id: 3865483
description:
Nov  6 16:27:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=45.227.32.114, lip=66.85.158.91, TLS, session=<K9Ch7epC7ewt4yBy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 16:40:12 host2 sshd[1557832]: Disconnected from invalid user caitlynn 62.60.131.157 port 13582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-06 16:45:14 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:41113: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-06 16:45:36 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:41924: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 16:46:44 host2 sshd[1564365]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov  6 16:51:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=</fl9QutCiqJChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-06 16:57:20 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:36607: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-06 16:57:33 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:60705: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-06 17:01:02 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:37729: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-11-06 17:00:31 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:52422: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-11-06 17:09:47 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:38285: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-11-06 17:10:11 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:54916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 17:15:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60027: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.229.16.142
country_id: 241170
description:
Nov  6 17:17:25 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=156.229.16.142, lip=66.85.158.91, session=<YO/7oOtCbMqc5RCO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-11-06 17:18:39 dovecot_login authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:55715: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-06 17:18:42 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:36356: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-06 17:19:15 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:8797: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.229.16.142
country_id: 241170
description:
Nov  6 17:19:21 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=156.229.16.142, lip=66.85.158.92, session=<7Hnip+tCGr2c5RCO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.30
country_id: 1733045
description:
2025-11-06 17:20:37 dovecot_login authenticator failed for ([49.124.151.30]) [49.124.151.30]:42918: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-06 17:33:11 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:50246: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2025-11-06 17:32:38 dovecot_login authenticator failed for ([49.124.145.62]) [49.124.145.62]:41720: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 17:33:28 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59911: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 17:38:02 host2 sshd[1614493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.213.230.149
country_id: 1512440
description:
Nov  6 17:39:39 host2 pure-ftpd[1616202]: (?@185.213.230.149) [INFO] New connection from 185.213.230.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-06 17:55:03 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:48143: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.70
country_id: 2635167
description:
Nov  6 17:54:13 host2 pure-ftpd[1632731]: (?@87.236.176.70) [INFO] New connection from 87.236.176.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-11-06 17:58:42 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:57258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-06 17:59:37 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:51770: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-06 17:59:48 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:50840: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.112
country_id: 2635167
description:
Nov  6 18:00:40 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.112, lip=66.85.158.92, TLS, session=<Gs6iO+xC/da594lw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.191
country_id: 3469034
description:
Nov  6 18:00:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=168.194.154.191, lip=66.85.158.91, TLS, session=<7vqCOuxC47Gowpq/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.125
country_id: 3175395
description:
Nov  6 18:01:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.178.125, lip=66.85.158.91, TLS, session=<CxD0O+xCQorZGrJ9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-06 18:07:44 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:33347: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.211.172
country_id: 1522867
description:
2025-11-06 18:08:00 dovecot_login authenticator failed for 178.89.211.172.dynamic.telecom.kz [178.89.211.172]:41467: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2025-11-06 18:08:33 dovecot_login authenticator failed for ([128.185.223.220]) [27.123.111.118]:48636: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:15:30 host2 sshd[1657373]: Disconnected from invalid user harsh 20.47.72.43 port 35108 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-06 18:16:38 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:45016: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-06 18:16:48 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:60423: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-06 18:16:57 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:51258: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-06 18:16:38 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:38902: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
country_id: 3175395
description:
2025-11-06 18:17:16 dovecot_login authenticator failed for 95-210-105-142.ip.skylogicnet.com [95.210.105.142]:33501: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:18:33 host2 sshd[1660727]: Disconnected from invalid user mk 20.47.72.43 port 39614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:19:59 host2 sshd[1661980]: Disconnected from invalid user schueler 20.47.72.43 port 55410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:21:25 host2 sshd[1663374]: Disconnected from invalid user testuser 20.47.72.43 port 56750 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.70.200.142
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.70.200.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.245.180.175
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 168.245.180.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.232.245
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.16.232.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.35.141.172
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 136.35.141.172 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.190.133.92
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 99.190.133.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.162.108.89
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.162.108.89 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.210.232.153
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.210.232.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 18:23:41 host2 sshd[1665833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.121
country_id: 953987
description:
Nov  6 18:24:18 host2 sshd[1666497]: Disconnected from invalid user debian 102.210.149.121 port 56826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Nov  6 18:26:03 host2 sshd[1668121]: Disconnected from invalid user ruby 102.210.149.121 port 33154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Nov  6 18:29:23 host2 sshd[1671644]: Disconnected from invalid user user 102.210.149.121 port 42268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  6 18:40:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<rwJTy+xC5pYjygmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.132
country_id: 1269750
description:
Nov  6 18:46:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.8.118.132, lip=66.85.158.91, TLS, session=<csLX3uxCAYlnCHaE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.153
country_id: 798544
description:
Nov  6 18:46:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=85.202.108.153, lip=66.85.158.91, TLS, session=<lhWw3exCsJJVymyZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-06 18:55:36 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:56035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-06 18:55:28 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:52521: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.188.81.67
country_id: 6252001
description:
Nov  6 19:04:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.188.81.67, lip=66.85.158.91, session=<Z5ueH+1CJuQ0vFFD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.224.96
country_id: 6252001
description:
Nov  6 19:07:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.118.224.96, lip=66.85.158.92, session=<FrVMKu1CxqEUduBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 19:15:18 host2 sshd[1717542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-06 19:17:59 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:52244: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-06 19:18:26 dovecot_login authenticator failed for ([46.149.83.62]) [46.149.83.62]:42971: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:18:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yR43Uu1CnIADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-06 19:18:10 dovecot_login authenticator failed for ([182.75.215.245]) [182.75.215.245]:60156: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-06 19:18:24 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:54156: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:19:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<r6wGV+1CBNYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:21:04 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VggmW+1CqMsDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:21:38 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<syssXe1CvsgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:24:05 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<45ftZe1CLusDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:24:12 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<I+pYZu1CqJkDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:25:21 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<BxB3au1C2LwDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:26:50 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<WIrJb+1CvOUDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:28:36 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<plAhdu1CXNYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:30:14 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<cHT2e+1CJLsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:31:20 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<p6nff+1CSK8DhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov  6 19:32:29 host2 sshd[1734380]: Disconnected from invalid user server2 193.106.245.20 port 37246 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:32:38 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<8+aNhO1CbqsDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:34:41 host2 dovecot[3154217]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<5H7gi+1CmrMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov  6 19:34:17 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, session=<KONsiu1CHjtBMQFQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:34:16 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<dt1liu1CtLMDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.67
country_id: 3469034
description:
Nov  6 19:35:19 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=138.36.202.67, lip=66.85.158.91, TLS, session=<3NzmjO1CIbOKJMpD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:35:22 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<T2tUju1CsMQDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.47
country_id: 3175395
description:
Nov  6 19:35:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=195.177.113.47, lip=66.85.158.91, TLS, session=<jDgzju1ChubDsXEv>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:36:17 host2 dovecot[3154217]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<NrmWke1CksMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:36:38 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<FFvTku1CTNMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 19:38:05 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<1rgLmO1CvtgDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Nov  6 19:40:06 host2 sshd[1742223]: Disconnected from invalid user nikita 193.106.245.20 port 53507 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov  6 19:41:07 host2 sshd[1743209]: Disconnected from invalid user mcuser 201.49.245.100 port 62839 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov  6 19:42:53 host2 sshd[1744772]: Disconnected from invalid user test 201.49.245.100 port 61895 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov  6 19:45:00 host2 sshd[1746653]: Disconnected from invalid user tester 193.106.245.20 port 54996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 19:46:37 host2 sshd[1748262]: Disconnected from invalid user user 2.57.121.25 port 51774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov  6 19:48:03 host2 sshd[1750021]: Disconnected from invalid user dima 189.112.0.11 port 56896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Nov  6 19:49:44 host2 sshd[1751428]: Disconnected from invalid user git 189.112.0.11 port 33022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.21.252.204
country_id: 3469034
description:
Nov  6 19:51:16 host2 sshd[1752999]: Disconnected from invalid user info 185.21.252.204 port 55250 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.87
country_id: 6252001
description:
Nov  6 19:55:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.155.87, lip=66.85.158.92, TLS: Connection closed, session=<RYWH1+1CpNrHLZtX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov  6 20:01:51 host2 sshd[1763142]: Disconnected from invalid user tech 51.222.106.104 port 39648 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 20:01:15 host2 sshd[1762664]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 166.88.101.185
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 166.88.101.185: 250 connections per 30 seconds to 587 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov  6 20:06:05 host2 sshd[1767627]: Disconnected from invalid user deploy 51.222.106.104 port 46658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Nov  6 20:07:18 host2 sshd[1768892]: Disconnected from invalid user frappe-user 51.222.106.104 port 41062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 20:15:25 host2 sshd[1776948]: Disconnected from invalid user cortney 62.60.131.157 port 21054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-06 20:20:18 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (oothoper) [217.215.74.195]:54815: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-06 20:24:40 dovecot_plain authenticator failed for (triony) [81.0.54.119]:51688: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.232
country_id: 6252001
description:
Nov  6 20:24:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.132.232, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<N+OPP+5Cus2TuYTo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.232
country_id: 6252001
description:
Nov  6 20:25:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.232, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<LJDRQu5C5OaTuYTo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.185.167
country_id: 2802361
description:
Nov  6 20:28:25 host2 pure-ftpd[1791776]: (?@35.195.185.167) [INFO] New connection from 35.195.185.167


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.232
country_id: 6252001
description:
Nov  6 20:29:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.232, lip=66.85.158.91, TLS, session=<wRF5Ue5C8vGTuYTo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.87
country_id: 2510769
description:
Nov  6 20:31:10 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.214.138.87, lip=66.85.158.91, TLS, session=<POPdVO5C+aa51opX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.211.62
country_id: 3175395
description:
Nov  6 20:31:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=94.198.211.62, lip=66.85.158.91, TLS, session=</wP0Ve5CvaRextM+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.75
country_id: 2750405
description:
Nov  6 20:37:12 host2 pure-ftpd[1800073]: (?@196.251.87.75) [INFO] New connection from 196.251.87.75


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  6 20:43:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<gsP0gO5CmryLonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.216.117
country_id: 6252001
description:
Nov  6 20:44:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.40.216.117, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DqgqhO5C0t0UKNh1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.254
country_id: 6252001
description:
Nov  6 20:45:12 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.254, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XhMIiO5CJKENWX3+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  6 20:47:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<yyZlj+5CJN8jygmF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 20:52:55 host2 sshd[1815442]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-06 20:54:49 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:60195: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-11-06 20:55:00 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:60280: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.141.37
country_id: 3374766
description:
2025-11-06 20:59:53 dovecot_plain authenticator failed for (faimia) [197.255.141.37]:35340: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-06 20:59:55 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (flugess) [73.13.220.220]:41344: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.252.207.216
country_id: 1643084
description:
Nov  6 21:02:31 host2 sshd[1825301]: Disconnected from invalid user ankit 180.252.207.216 port 46882 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.96
country_id: 6252001
description:
Nov  6 21:04:35 host2 pure-ftpd[1828036]: (?@205.210.31.96) [INFO] New connection from 205.210.31.96


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.80
country_id: 6252001
description:
Nov  6 21:04:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=199.45.155.80, lip=66.85.158.91, TLS: Connection closed, session=<IrWVze5CXsfHLZtQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.207.216
country_id: 1643084
description:
Nov  6 21:08:44 host2 sshd[1832373]: Disconnected from invalid user scanner 180.252.207.216 port 59616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 21:20:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56660: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 21:26:31 host2 sshd[1849916]: Disconnected from invalid user darlene 62.60.131.157 port 44365 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.150
country_id: 3469034
description:
Nov  6 21:27:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.137.150, lip=66.85.158.91, TLS, session=<A4lVH+9C/c2+WYmW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.225
country_id: 3469034
description:
Nov  6 21:27:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=190.89.136.225, lip=66.85.158.91, TLS, session=<WkgfHu9CO9e+WYjh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.95.66
country_id: 3469034
description:
Nov  6 21:30:12 host2 sshd[1853690]: Disconnected from invalid user mini 187.45.95.66 port 59419 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.122
country_id: 6252001
description:
Nov  6 21:30:48 host2 pure-ftpd[1854238]: (?@64.62.197.122) [INFO] New connection from 64.62.197.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov  6 21:31:00 host2 sshd[1854385]: Disconnected from invalid user testuser 51.75.27.166 port 48720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov  6 21:31:55 host2 sshd[1855193]: Disconnected from invalid user tw 95.58.255.251 port 46054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov  6 21:33:17 host2 sshd[1856862]: Disconnected from invalid user sysadmin 45.169.200.254 port 45692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Nov  6 21:33:29 host2 sshd[1857087]: Disconnected from invalid user allinone 181.188.172.6 port 37999 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov  6 21:34:07 host2 sshd[1857818]: Disconnected from invalid user allinone 51.75.27.166 port 48654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Nov  6 21:35:25 host2 sshd[1859468]: Disconnected from invalid user developer 51.75.27.166 port 43662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov  6 21:36:00 host2 sshd[1860110]: Disconnected from invalid user user1 45.169.200.254 port 57564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.254.118
country_id: 357994
description:
Nov  6 21:35:08 host2 sshd[1859184]: Disconnected from invalid user ai 197.134.254.118 port 57335 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov  6 21:37:37 host2 sshd[1862288]: Disconnected from invalid user andrea 45.169.200.254 port 59180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.95.66
country_id: 3469034
description:
Nov  6 21:39:05 host2 sshd[1863959]: Disconnected from invalid user weblogic 187.45.95.66 port 28891 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 21:38:38 host2 sshd[1863447]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.169.200.254
country_id: 3469034
description:
Nov  6 21:39:22 host2 sshd[1864236]: Disconnected from invalid user es 45.169.200.254 port 60806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.38.76
country_id: 357994
description:
Nov  6 21:39:44 host2 sshd[1864659]: Disconnected from invalid user alex 196.221.38.76 port 42472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov  6 21:40:05 host2 sshd[1865201]: Disconnected from invalid user xuhao 95.58.255.251 port 33302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 21:39:13 host2 sshd[1864100]: Disconnected from invalid user user 2.57.121.25 port 47322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-06 21:40:19 dovecot_plain authenticator failed for (reragable) [192.34.128.202]:32900: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-06 21:40:21 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (deral) [174.59.253.88]:51750: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.95.66
country_id: 3469034
description:
Nov  6 21:40:34 host2 sshd[1865771]: Disconnected from invalid user ai 187.45.95.66 port 65356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov  6 21:40:44 host2 sshd[1865899]: Disconnected from invalid user server 51.75.27.166 port 46274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  6 21:41:20 host2 sshd[1866760]: Disconnected from invalid user weblogic 197.134.250.149 port 60106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-06 21:41:35 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:38464: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-06 21:41:47 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:40352: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 21:42:19 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:51596: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.222
country_id: 357994
description:
2025-11-06 21:42:47 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:65373: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.232.26
country_id: 3469034
description:
2025-11-06 21:42:21 dovecot_login authenticator failed for (187-40-1-41.user.veloxzone.com.br) [200.223.232.26]:35765: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.52.145.117
country_id: 2802361
description:
Nov  6 21:43:26 host2 pure-ftpd[1872851]: (?@34.52.145.117) [INFO] New connection from 34.52.145.117


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Nov  6 21:44:04 host2 sshd[1879465]: Disconnected from invalid user ubuntu 181.188.172.6 port 42893 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.61
country_id: 2750405
description:
Nov  6 21:44:36 host2 pure-ftpd[1882525]: (?@196.251.87.61) [INFO] New connection from 196.251.87.61


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 21:45:45 host2 sshd[1884224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Nov  6 21:45:34 host2 sshd[1884005]: Disconnected from invalid user deploy 181.188.172.6 port 57489 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov  6 21:45:12 host2 sshd[1883490]: Disconnected from invalid user emilia 95.58.255.251 port 60350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov  6 21:48:34 host2 sshd[1887214]: Disconnected from invalid user agent 95.58.255.251 port 53426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov  6 21:50:20 host2 sshd[1889028]: Disconnected from invalid user jerry 95.58.255.251 port 47196 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.197
country_id: 6252001
description:
Nov  6 21:52:03 host2 pure-ftpd[1890989]: (?@205.210.31.197) [INFO] New connection from 205.210.31.197


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Nov  6 21:52:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eRazd+9C+GNBMQFC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.204.150
country_id: 357994
description:
Nov  6 21:55:14 host2 sshd[1894551]: Disconnected from invalid user mini 196.221.204.150 port 15599 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2025-11-06 21:58:43 dovecot_login authenticator failed for ([128.185.247.127]) [182.95.223.142]:38540: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-06 22:00:08 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:53958: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.153.115.3
country_id: 2921044
description:
2025-11-06 22:00:21 dovecot_login authenticator failed for ([148.153.115.3]) [148.153.115.3]:1978: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.38.56
country_id: 357994
description:
Nov  6 22:13:46 host2 sshd[1913832]: Disconnected from invalid user testuser 196.221.38.56 port 18709 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.204.150
country_id: 357994
description:
Nov  6 22:16:47 host2 sshd[1917002]: Disconnected from invalid user nagios 196.221.204.150 port 52023 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.254.118
country_id: 357994
description:
Nov  6 22:19:51 host2 sshd[1919782]: Disconnected from invalid user dbadmin 197.134.254.118 port 19420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  6 22:22:53 host2 sshd[1923256]: Disconnected from invalid user ubuntu 197.134.250.149 port 52532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.84
country_id: 3175395
description:
Nov  6 22:23:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.15.171.84, lip=66.85.158.91, TLS, session=<JJ/l5+9Cj7C5D6tU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.152
country_id: 1269750
description:
Nov  6 22:24:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.18.166.152, lip=66.85.158.91, TLS, session=<Ws4U6e9Cct1nEqaY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.221.157.140
country_id: 6252001
description:
Nov  6 22:25:10 host2 pure-ftpd[1926130]: (?@54.221.157.140) [INFO] New connection from 54.221.157.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-06 22:28:44 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (hytion) [73.13.220.220]:59422: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 22:29:48 host2 sshd[1930733]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.185.101
country_id: 2921044
description:
Nov  6 22:30:23 host2 sshd[1931482]: Invalid user secondcoffeeinternational from 164.92.185.101 port 37142


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-06 22:31:05 dovecot_plain authenticator failed for (priacke) [92.62.243.154]:60719: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Nov  6 22:33:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.132, lip=66.85.158.92, TLS: Connection closed, session=<0XrOCfBCSJZBMQGE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.141
country_id: 6252001
description:
Nov  6 22:32:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.141, lip=66.85.158.92, session=<Dt4iCfBCN9BBMQGN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-06 22:35:33 dovecot_plain authenticator failed for (obiaze) [24.187.213.29]:54010: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 22:36:48 host2 sshd[1938819]: Disconnected from invalid user irvin 62.60.131.157 port 19722 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.223.188.90
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 111.223.188.90 - anandaoba "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaoba (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 22:45:53 host2 sshd[1949406]: Disconnected from invalid user irvin 62.60.131.157 port 14130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-06 22:46:59 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:37880: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.236
country_id: 6252001
description:
Nov  6 22:47:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.150.236, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<H8KOPPBC8tei2Jbs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-06 22:47:31 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:49760: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.236
country_id: 6252001
description:
Nov  6 22:48:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.236, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<UjvdP/BCKPOi2Jbs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.236
country_id: 6252001
description:
Nov  6 22:52:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.236, lip=66.85.158.92, TLS, session=<5euwTfBCav6i2Jbs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.27
country_id: 1819730
description:
Nov  6 22:56:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.27, lip=66.85.158.92, TLS, session=<5lMwX/BCbt0tjpob>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 22:57:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3Go4YPBCEtcDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 22:57:24 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:60623: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-06 22:57:58 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:46674: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 22:58:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<V+NJY/BCurUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 22:59:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iP2YaPBC4LIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-06 22:59:51 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:39506: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-06 23:00:01 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:19893: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-06 23:01:30 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:42308: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 23:01:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<WIfAb/BCQI8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-06 23:01:41 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:47462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 23:01:44 host2 sshd[1968423]: Disconnected from invalid user jairo 62.60.131.157 port 31114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 23:03:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<kXhLd/BC9M0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 23:04:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Xwale/BCypkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  6 23:05:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<hZ6UfvBCKNMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov  6 23:08:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<wC4civBCRqy4aYtG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 23:14:51 host2 sshd[1984164]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 23:17:45 host2 sshd[1987641]: Disconnected from invalid user user 2.57.121.25 port 10892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.118
country_id: 732800
description:
Nov  6 23:20:21 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.255.212.118, lip=66.85.158.91, TLS, session=<DT3YsfBCKJO5/9R2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.54
country_id: 953987
description:
Nov  6 23:20:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.64.39.54, lip=66.85.158.91, TLS, session=<adoRs/BCpY5mQCc2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.127
country_id: 6252001
description:
Nov  6 23:21:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.127, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YyPytfBC0eBAPpx/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov  6 23:21:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4jsGt/BCvExAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov  6 23:21:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<RWaft/BC0nhAPpx6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.210.33.193
country_id: 2233387
description:
Nov  6 23:21:45 host2 sshd[1992319]: Invalid user secondcoffeeinternational from 165.210.33.193 port 40394


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.202
country_id: 1819730
description:
2025-11-06 23:22:53 dovecot_login authenticator failed for (m121-202-207-202.smartone.com) [121.202.207.202]:41458: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-06 23:23:09 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:45471: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.20.164.106
country_id: 2464461
description:
2025-11-06 23:31:11 dovecot_plain authenticator failed for ([10.5.0.2]) [197.20.164.106]:4671: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-11-06 23:33:48 dovecot_plain authenticator failed for (tecons) [65.20.129.28]:43595: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Nov  6 23:33:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<34Bb4/BC8l5APpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.173
country_id: 6252001
description:
Nov  6 23:33:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.173, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2BpH4vBC0zxAPpyt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.223.188.90
country_id: 1227603
description:
[2025-11-06 23:36:19 +0530] info [cpaneld] 111.223.188.90 - anandaob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User anandaob has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.223.188.90
country_id: 1227603
description:
[2025-11-06 23:36:50 +0530] info [cpaneld] 111.223.188.90 - anandaob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User anandaob has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.20.164.106
country_id: 2464461
description:
2025-11-06 23:38:03 dovecot_plain authenticator failed for ([10.5.0.2]) [197.20.164.106]:4991: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Nov  6 23:42:29 host2 pure-ftpd[2016129]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Nov  6 23:45:19 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UyI4DPFC6l1APsUg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-11-06 23:46:06 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:41163: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-06 23:46:32 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:56487: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  6 23:45:32 host2 sshd[2019703]: Invalid user secondcoffeeinternational from 118.193.38.159 port 38474


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Nov  6 23:45:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cld2DfFC5pNAPsUg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  6 23:50:05 host2 sshd[2025702]: Invalid user secondcoffeeinternational from 43.225.52.249 port 51124


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.214.142
country_id: 1269750
description:
Nov  6 23:57:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.214.142, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qXLmNvFC3tylFtaO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov  6 23:56:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.91, session=<7PtRNfFCUOTY2s5C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-06 23:58:11 dovecot_plain authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net (tamic) [50.127.177.194]:41662: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.238.55.194
country_id: 6252001
description:
2025-11-06 23:58:15 dovecot_plain authenticator failed for (rouss) [50.238.55.194]:48897: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-06 23:59:35 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:50227: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-11-07 00:00:02 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:63688: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-07 00:02:27 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:53884: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-07 00:01:36 dovecot_plain authenticator failed for (spions) [92.62.243.174]:50960: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-07 00:01:59 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:54310: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-07 00:03:09 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:45640: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.233.211
country_id: 6252001
description:
Nov  7 00:05:06 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.99.233.211, lip=66.85.158.92, session=<0j/6UvFCJtynY+nT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov  7 00:05:56 host2 pure-ftpd[2044277]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-07 00:08:11 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:46326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-07 00:07:45 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:42607: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 00:14:31 host2 sshd[2054079]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.1.102
country_id: 1605651
description:
Nov  7 00:19:27 host2 sshd[2059238]: Invalid user secondcoffeeinternational from 43.164.1.102 port 43664


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.134.24
country_id: 1269750
description:
Nov  7 00:19:49 host2 sshd[2059768]: Disconnected from invalid user trans 64.227.134.24 port 60296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.134.24
country_id: 1269750
description:
Nov  7 00:26:22 host2 sshd[2067552]: Disconnected from invalid user leon 64.227.134.24 port 57428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 00:29:51 host2 sshd[2071251]: Disconnected from invalid user jairo 62.60.131.157 port 9331 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov  7 00:32:12 host2 sshd[2073998]: Disconnected from invalid user grass 103.157.25.60 port 41556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-07 00:33:31 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (apest) [81.226.88.121]:54599: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-11-07 00:33:36 dovecot_plain authenticator failed for (miteexcule) [65.20.129.28]:43156: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.66
country_id: 1643084
description:
Nov  7 00:36:10 host2 sshd[2079092]: Disconnected from invalid user nps 103.31.39.66 port 59728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.157.25.60
country_id: 1643084
description:
Nov  7 00:36:49 host2 sshd[2080008]: Disconnected from invalid user technik 103.157.25.60 port 53630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  7 00:38:59 host2 sshd[2082556]: Invalid user secondcoffeeinternational from 43.225.52.249 port 50082


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov  7 00:39:48 host2 sshd[2083530]: Disconnected from invalid user persona 103.157.25.60 port 33442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 00:42:53 host2 sshd[2087174]: Disconnected from invalid user user 2.57.121.25 port 49121 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.45.7.240
country_id: 102358
description:
2025-11-07 00:43:00 dovecot_plain authenticator failed for ([89.116.164.85]) [176.45.7.240]:50628: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.163.99.4
country_id: 3469034
description:
2025-11-07 00:43:13 dovecot_plain authenticator failed for ([89.116.164.85]) [164.163.99.4]:45862: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov  7 00:42:42 host2 sshd[2086880]: Disconnected from invalid user student1 103.157.25.60 port 41480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.168.144.50
country_id: 6252001
description:
2025-11-07 00:43:32 dovecot_plain authenticator failed for ([89.116.164.85]) [72.168.144.50]:6988: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.66
country_id: 1643084
description:
Nov  7 00:47:27 host2 sshd[2092914]: Disconnected from invalid user yusuf 103.31.39.66 port 60276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
country_id: 1819730
description:
2025-11-07 00:49:55 dovecot_login authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:60043: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-11-07 00:50:58 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:52388: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.39.66
country_id: 1643084
description:
Nov  7 00:52:08 host2 sshd[2098664]: Disconnected from invalid user roman 103.31.39.66 port 33876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.57
country_id: 6251999
description:
Nov  7 00:57:15 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.193.57, lip=66.85.158.91, session=<JPVzDfJCztqUccE5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 00:59:18 host2 sshd[2107438]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-07 01:01:02 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:51014: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.12
country_id: 6252001
description:
Nov  7 01:01:11 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZZSMG/JCl4vDuEwM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-11-07 01:01:18 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:49990: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.235
country_id: 6252001
description:
Nov  7 01:01:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.235, lip=66.85.158.91, TLS: Connection closed, session=<MSs6HPJCX6HDuEzr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.233
country_id: 6252001
description:
Nov  7 01:01:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.233, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LCOYHPJCR4vDuEzp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.11
country_id: 6252001
description:
Nov  7 01:01:32 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.11, lip=66.85.158.91, TLS: Connection closed, session=<ZOnGHPJCkebDuEwL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-07 01:09:06 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (chotiolar) [73.68.220.15]:44354: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.156.93.100
country_id: 6251999
description:
Nov  7 01:13:12 host2 sshd[2123318]: Disconnected from invalid user luis 69.156.93.100 port 45124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Nov  7 01:14:15 host2 sshd[2124698]: Disconnected from invalid user pzserver 201.184.50.251 port 59038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.156.93.100
country_id: 6251999
description:
Nov  7 01:14:25 host2 sshd[2124848]: Disconnected from invalid user ais 69.156.93.100 port 46008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.131
country_id: 1269750
description:
Nov  7 01:19:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.164.246.131, lip=66.85.158.91, TLS, session=<ONjVW/JCyc5npPaD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.113.112.22
country_id: 1269750
description:
Nov  7 01:19:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.113.112.22, lip=66.85.158.91, TLS, session=<2pgHXfJCS+ZncXAW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Nov  7 01:24:12 host2 sshd[2136319]: Disconnected from invalid user cisco 201.184.50.251 port 58248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-07 01:26:26 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (ovolly) [73.176.157.57]:53680: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.233.211
country_id: 6252001
description:
Nov  7 01:30:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.99.233.211, lip=66.85.158.91, session=<Bl2SgvJCHImnY+nT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.216.171.20
country_id: 6252001
description:
[2025-11-07 01:34:08 +0530] info [cpaneld] 108.216.171.20 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.176.207.186
country_id: 6252001
description:
[2025-11-07 01:34:11 +0530] info [cpaneld] 108.176.207.186 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.212.107.163
country_id: 6252001
description:
[2025-11-07 01:34:13 +0530] info [cpaneld] 69.212.107.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.38.112
country_id: 6252001
description:
[2025-11-07 01:34:19 +0530] info [whostmgrd] 47.152.38.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.16.22.31
country_id: 6252001
description:
[2025-11-07 01:34:29 +0530] info [cpaneld] 216.16.22.31 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.100.93.188
country_id: 6252001
description:
[2025-11-07 01:34:27 +0530] info [cpaneld] 99.100.93.188 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.84.151
country_id: 6252001
description:
[2025-11-07 01:34:22 +0530] info [cpaneld] 207.66.84.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-07 01:44:34 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64009: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.251
country_id: 1269750
description:
Nov  7 01:47:38 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.237.58.251, lip=66.85.158.91, TLS, session=<3jJ2wPJCQJFn7Tr7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.16.39
country_id: 3175395
description:
Nov  7 01:47:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.43.16.39, lip=66.85.158.91, TLS, session=<Acu/wfJCbrW5KxAn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 01:50:04 host2 sshd[2168142]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-07 01:55:15 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:49990: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-07 01:57:25 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:57650: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-07 01:57:42 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:51771: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.10.20.95
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.10.20.95 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.187.214.139
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 173.187.214.139 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.73.99.139
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 66.73.99.139 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.55.50.160
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.55.50.160 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.244.12.84
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 136.244.12.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.66.43.158
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.66.43.158 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.90.144.25
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.90.144.25 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.165.191.108
country_id: 1861060
description:
Nov  7 02:05:21 host2 sshd[2187844]: Disconnected from invalid user profesor 43.165.191.108 port 52370 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.46.249.123
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.46.249.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.154.118
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 69.120.154.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.166
country_id: 6252001
description:
Nov  7 02:06:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.166, lip=66.85.158.91, TLS, session=<K/3dBfNC8OvG6xim>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.81.114.8
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.81.114.8 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.101.11.7
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 174.101.11.7 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.128.57
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 172.59.128.57 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.5.194.60
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.5.194.60 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.255.149.79
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.255.149.79 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.165.191.108
country_id: 1861060
description:
Nov  7 02:09:10 host2 sshd[2192536]: Disconnected from invalid user dayz 43.165.191.108 port 43188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov  7 02:10:40 host2 sshd[2194657]: Disconnected from invalid user system 34.58.124.191 port 54566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.181
country_id: 6252001
description:
Nov  7 02:10:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.181, lip=66.85.158.92, TLS, session=<X6qQFPNCUPTG6xi1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  7 02:12:23 host2 sshd[2196728]: Invalid user secondcoffeeinternational from 118.193.38.159 port 33956


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.165.191.108
country_id: 1861060
description:
Nov  7 02:13:26 host2 sshd[2197945]: Disconnected from invalid user mssql 43.165.191.108 port 39040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-07 02:13:54 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:45401: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.125.83.110
country_id: 630336
description:
2025-11-07 02:14:19 dovecot_login authenticator failed for leased-line-93-125-83-110.telecom.by [93.125.83.110]:40563: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.172
country_id: 6252001
description:
Nov  7 02:14:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.172, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6PjLIvNCC8/N0h+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov  7 02:16:13 host2 sshd[2201496]: Disconnected from invalid user prashanth 34.58.124.191 port 54214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  7 02:17:04 host2 sshd[2202521]: Invalid user secondcoffeeinternational from 43.225.52.249 port 51324


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Nov  7 02:18:56 host2 sshd[2204751]: Disconnected from invalid user simon 34.58.124.191 port 46942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-07 02:20:02 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:49301: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-07 02:21:19 dovecot_plain authenticator failed for (mistiont) [80.227.102.242]:36190: 535 Incorrect authentication data (set_id=sales@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov  7 02:22:04 host2 sshd[2208998]: Disconnected from invalid user admin 34.58.124.191 port 56804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-07 02:24:49 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:52233: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-11-07 02:25:14 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:44376: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.208.158
country_id: 6252001
description:
Nov  7 02:25:27 host2 pure-ftpd[2213106]: (?@146.190.208.158) [INFO] New connection from 146.190.208.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-07 02:26:29 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:59480: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-11-07 02:26:41 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:38876: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-07 02:27:55 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:41453: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-07 02:28:07 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:44798: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-11-07 02:30:15 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (lactushite) [76.31.164.124]:50660: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-11-07 02:32:55 dovecot_plain authenticator failed for (aurget) [88.149.153.106]:54588: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 02:32:45 host2 sshd[2221864]: Disconnected from invalid user user 2.57.121.25 port 51016 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 02:34:40 host2 sshd[2224020]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-07 02:35:12 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:38558: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.14
country_id: 298795
description:
2025-11-07 02:35:27 dovecot_login authenticator failed for (88.255.189.14.static.ttnet.com.tr) [88.255.189.14]:54150: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-07 02:36:17 dovecot_plain authenticator failed for (denqua) [65.20.147.45]:53175: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 02:36:46 host2 sshd[2226640]: Disconnected from invalid user norman 62.60.131.157 port 32424 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.179.215
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.56.179.215 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-07 02:38:21 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:44466: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-07 02:38:32 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:53072: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.88.93.171
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.88.93.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.39.127.124
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 99.39.127.124 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.164.105.71
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 97.164.105.71 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.151.3.158
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.151.3.158 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.171.170.215
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.171.170.215 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.37.77.110
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.37.77.110 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.47
country_id: 2264397
description:
Nov  7 02:40:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.197.47, lip=66.85.158.91, TLS, session=<25EJffNC0uG54sUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.49
country_id: 2264397
description:
Nov  7 02:40:00 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.226.197.49, lip=66.85.158.91, TLS, session=<fGHwfPNCgeK54sUx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.48
country_id: 2264397
description:
Nov  7 02:40:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.226.197.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ewYlffNCiam54sUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.49
country_id: 2264397
description:
Nov  7 02:40:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=185.226.197.49, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<zYdYffNCI4W54sUx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.206.43.223
country_id: 6252001
description:
2025-11-07 02:40:30 dovecot_plain authenticator failed for c-73-206-43-223.hsd1.tx.comcast.net (gleampally) [73.206.43.223]:42330: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.85
country_id: 6252001
description:
Nov  7 02:46:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.85, lip=66.85.158.91, TLS, session=<PSOWk/NC4OAUQcJV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.48.42.11
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.48.42.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.57.49.197
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 136.57.49.197 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.143.77
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 73.199.143.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.9.223.76
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.9.223.76 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.37.246.152
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.37.246.152 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.250.135.9
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.250.135.9 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.9.152.136
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.9.152.136 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.51.209.101
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.51.209.101 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.73.220.32
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.73.220.32 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.44.143
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.33.44.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.52.200.48
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 64.52.200.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.24.1.42
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.24.1.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.73.196.230
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 66.73.196.230 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.238.190.192
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.238.190.192 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov  7 02:52:41 host2 sshd[2245811]: Disconnected from invalid user thomas 82.65.43.136 port 50226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 02:54:33 host2 sshd[2248207]: Disconnected from invalid user user 2.57.121.25 port 22989 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov  7 02:55:47 host2 sshd[2249946]: Disconnected from invalid user mcadmin 82.65.43.136 port 43326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov  7 02:58:07 host2 sshd[2252427]: Disconnected from invalid user log 82.65.43.136 port 44530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Nov  7 02:59:31 host2 sshd[2253787]: Disconnected from invalid user test 103.123.53.88 port 60242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.65.43.136
country_id: 3017382
description:
Nov  7 03:01:30 host2 sshd[2256262]: Disconnected from invalid user mahsa 82.65.43.136 port 46336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  7 03:01:24 host2 sshd[2256184]: Invalid user secondcoffeeinternational from 118.193.38.159 port 48854


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Nov  7 03:06:22 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.242, lip=66.85.158.91, TLS, session=<MFY92/NCxvzG6xjy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov  7 03:05:56 host2 sshd[2261534]: Disconnected from invalid user email 82.65.43.136 port 48730 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.167.30
country_id: 6252001
description:
Nov  7 03:07:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.167.30, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<29mM3/NCEsIUU6ce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.95.89.162
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.95.89.162 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.17.177
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 35.149.17.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.52.135.234
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 208.52.135.234 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.80.200
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.175.80.200 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.103.144.0
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 216.103.144.0 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.1.171.63
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.1.171.63 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.152.1.68
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 63.152.1.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Nov  7 03:12:30 host2 sshd[2268927]: Disconnected from invalid user amit 103.123.53.88 port 47030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-07 03:12:49 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:13284: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-07 03:13:07 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:51484: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.147
country_id: 3017382
description:
Nov  7 03:16:38 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wt/s//NCw61b51mT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.235
country_id: 3017382
description:
Nov  7 03:16:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.235, lip=66.85.158.91, TLS: Connection closed, session=<Pn2UAPRCF8Zb51nr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.149
country_id: 3017382
description:
Nov  7 03:17:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.149, lip=66.85.158.91, TLS: Connection closed, session=<ymiiAfRC/Zxb51mV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.220
country_id: 6252001
description:
Nov  7 03:20:01 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.220, lip=66.85.158.92, session=<do0ADPRCZrus7OTc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 03:25:18 host2 sshd[2283799]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.132
country_id: 6252001
description:
Nov  7 03:26:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 55 secs): user=<>, rip=199.45.154.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<V6RVI/RCqt3HLZqE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.132
country_id: 6252001
description:
Nov  7 03:27:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=199.45.154.132, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<63/6JfRCELzHLZqE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.65
country_id: 3865483
description:
Nov  7 03:37:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=190.181.89.65, lip=66.85.158.91, TLS, session=<som2R/RCO5S+tVlB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.2.189.222
country_id: 798544
description:
Nov  7 03:37:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=83.2.189.222, lip=66.85.158.91, TLS, session=<Hov7SPRCAJ5TAr3e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.1.102
country_id: 1605651
description:
Nov  7 03:39:05 host2 sshd[2301770]: Invalid user secondcoffeeinternational from 43.164.1.102 port 56672


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-07 03:39:36 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (anter) [98.227.25.115]:56100: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Nov  7 03:42:45 host2 sshd[2305703]: Disconnected from invalid user alex 202.165.15.132 port 38693 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.216.53.70
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.216.53.70 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.195.33.166
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 216.195.33.166 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.110.98.178
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 50.110.98.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov  7 03:47:45 host2 sshd[2312575]: Disconnected from invalid user alex 118.193.61.170 port 42300 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.90.183.88
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 208.90.183.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.225.95.78
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.225.95.78 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.83.119.56
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.83.119.56 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.228.164.15
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.228.164.15 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-07 03:49:23 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:49602: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.145.27
country_id: 290557
description:
2025-11-07 03:49:41 dovecot_login authenticator failed for ([91.74.145.27]) [91.74.145.27]:53438: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  7 03:50:05 host2 sshd[2315790]: Invalid user secondcoffeeinternational from 118.193.38.159 port 36098


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.107.95.107
country_id: 3469034
description:
Nov  7 03:50:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.107.95.107, lip=66.85.158.91, TLS, session=<9Bz4d/RCh4axa19r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.245.236
country_id: 798544
description:
Nov  7 03:50:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.125.245.236, lip=66.85.158.91, TLS, session=<v2ciefRC9LltffXs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov  7 03:51:04 host2 sshd[2317137]: Disconnected from invalid user hassan 118.193.61.170 port 50168 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Nov  7 03:52:41 host2 sshd[2319014]: Disconnected from invalid user ftptest 118.193.61.170 port 39708 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.227.20
country_id: 6252001
description:
Nov  7 03:54:53 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.118.227.20, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<SDu8iPRCLrMUduMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.185
country_id: 6252001
description:
Nov  7 03:55:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.173.185, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MoAcifRCKp8ofK25>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.248
country_id: 6252001
description:
Nov  7 03:56:45 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.248, lip=66.85.158.92, session=<WXhjj/RCdOLN0h/4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov  7 03:57:46 host2 sshd[2325776]: Disconnected from invalid user admin 118.193.61.170 port 38308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-07 04:01:32 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:17262: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-07 04:01:48 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:39400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.214
country_id: 6252001
description:
Nov  7 04:04:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.214, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<selcqfRCwcbN0h/W>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.43
country_id: 2635167
description:
Nov  7 04:06:08 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.43, lip=66.85.158.92, TLS, session=</Hz0sPRCG4W594kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.31
country_id: 2635167
description:
Nov  7 04:06:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.31, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<QwEGsfRCGY+594kf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.3
country_id: 2635167
description:
Nov  7 04:06:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.3, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lnMBs/RCYadX7LAD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.140
country_id: 6252001
description:
Nov  7 04:06:44 host2 pure-ftpd[2337068]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.139
country_id: 6252001
description:
Nov  7 04:07:03 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.139, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UOYztPRCqN/G6xiL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.31
country_id: 2635167
description:
Nov  7 04:07:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.31, lip=66.85.158.92, TLS handshaking: Connection closed, session=<zsX8tPRCpeZX7LAf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.12
country_id: 2635167
description:
Nov  7 04:08:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.12, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=</6/zuPRCQeJX7LAM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.32
country_id: 2635167
description:
Nov  7 04:07:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.32, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<EFr4tvRCMau594kg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.16
country_id: 2635167
description:
Nov  7 04:08:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.16, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fCbtuvRCp5FX7LAQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.24
country_id: 2635167
description:
Nov  7 04:09:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.24, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<+57qvPRCq85X7LAY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 04:10:02 host2 sshd[2341006]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.35
country_id: 2635167
description:
Nov  7 04:10:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.35, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<fRzmvvRCj7RX7LAj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Nov  7 04:10:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<KmXfwPRCL8O594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Nov  7 04:11:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<UeXawvRCEcpX7LAK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Nov  7 04:15:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Kudj0/RCpsXN0h9W>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.164.133
country_id: 2921044
description:
Nov  7 04:18:38 host2 pure-ftpd[2352148]: (?@165.227.164.133) [INFO] New connection from 165.227.164.133


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.248.142.207
country_id: 2921044
description:
Nov  7 04:18:39 host2 pure-ftpd[2352150]: (?@104.248.142.207) [INFO] New connection from 104.248.142.207


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 04:20:20 host2 sshd[2353131]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  7 04:29:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<z4ASBvVC/uWLonQW>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-07 04:33:56 H=([87.120.36.32]) [87.120.36.32]:50184 F=<info@wikipedia.org> rejected RCPT <mikek@gibsontruckworld.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-07 04:41:43 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:60756: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-11-07 04:43:08 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (aociber) [68.83.181.181]:37318: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.207.250.28
country_id: 130758
description:
2025-11-07 04:45:18 dovecot_plain authenticator failed for (spifine) [213.207.250.28]:50972: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.219.38
country_id: 3865483
description:
Nov  7 04:46:11 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.1.219.38, lip=66.85.158.91, TLS, session=<ZmAbP/VCnuS6Adsm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.37
country_id: 3469034
description:
Nov  7 04:46:32 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.129.37, lip=66.85.158.91, TLS, session=<Bq5SQPVCYN2/NYEl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Nov  7 04:46:50 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.123, lip=66.85.158.92, TLS, session=<ZOx/QvVCduyTuYR7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 04:47:00 host2 sshd[2395003]: Disconnected from invalid user london 62.60.131.157 port 26475 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-11-07 04:50:41 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:46495: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-07 04:51:03 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:55797: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
country_id: 6252001
description:
2025-11-07 04:51:19 dovecot_login authenticator failed for ([162.186.17.150]) [162.186.17.150]:54207: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-11-07 04:52:26 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:37928: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 05:00:43 host2 sshd[2415931]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.118.222.44
country_id: 6252001
description:
[2025-11-07 05:00:33 +0530] info [cpaneld] 97.118.222.44 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.30.154.42
country_id: 6252001
description:
[2025-11-07 05:00:41 +0530] info [cpaneld] 45.30.154.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.43.215
country_id: 6252001
description:
[2025-11-07 05:00:42 +0530] info [cpaneld] 107.197.43.215 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.185.100
country_id: 6252001
description:
[2025-11-07 05:00:50 +0530] info [whostmgrd] 76.33.185.100 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.202.10.175
country_id: 6252001
description:
[2025-11-07 05:01:01 +0530] info [cpaneld] 104.202.10.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.125.245.216
country_id: 6252001
description:
[2025-11-07 05:00:56 +0530] info [cpaneld] 69.125.245.216 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.25.9.9
country_id: 6252001
description:
[2025-11-07 05:00:58 +0530] info [cpaneld] 76.25.9.9 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.200
country_id: 1880251
description:
Nov  7 05:08:33 host2 sshd[2425649]: Disconnected from invalid user test2 45.78.219.200 port 37340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.114
country_id: 1269750
description:
2025-11-07 05:09:31 dovecot_login authenticator failed for ([59.145.219.185]) [182.95.52.114]:58168: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-11-07 05:10:14 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:49826: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-11-07 05:10:29 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:58671: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-07 05:10:35 dovecot_plain authenticator failed for (hedanist) [102.53.15.18]:52199: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Nov  7 05:17:41 host2 sshd[2436310]: Disconnected from invalid user carla 122.54.18.220 port 59555 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Nov  7 05:21:07 host2 sshd[2440305]: Disconnected from invalid user ts3user 122.54.18.220 port 56877 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.54.18.220
country_id: 1694008
description:
Nov  7 05:22:39 host2 sshd[2442074]: Disconnected from invalid user admin 122.54.18.220 port 40614 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.110
country_id: 6252001
description:
Nov  7 05:25:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.110, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6+kAzPVCLN3G6xhu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.124
country_id: 6252001
description:
Nov  7 05:25:59 host2 pure-ftpd[2446172]: (?@198.235.24.124) [INFO] New connection from 198.235.24.124


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-07 05:26:12 H=([87.120.36.32]) [87.120.36.32]:58793 F=<info@wikipedia.org> rejected RCPT <mikek@gibsontruckworld.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.200
country_id: 1880251
description:
Nov  7 05:26:37 host2 sshd[2446777]: Disconnected from invalid user zy 45.78.219.200 port 43044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-07 05:28:18 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:33468: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-07 05:27:59 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:58470: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-07 05:29:43 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:49414: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-07 05:29:59 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:58628: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  7 05:31:45 host2 sshd[2452729]: Invalid user secondcoffeeinternational from 43.225.52.249 port 60162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Nov  7 05:31:19 host2 sshd[2452247]: Disconnected from invalid user kt 122.54.18.220 port 44279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-07 05:34:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51068: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.51.161.9
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 158.51.161.9 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.131.39.246
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.131.39.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.210.55.26
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 198.210.55.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.253.18
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.179.253.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.219.200
country_id: 1880251
description:
Nov  7 05:40:13 host2 sshd[2462175]: Disconnected from invalid user ricardo 45.78.219.200 port 36754 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.28.123.183
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.28.123.183 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.248.124.173
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 96.248.124.173 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.102.5.45
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 97.102.5.45 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  7 05:41:26 host2 sshd[2463659]: Invalid user agronatureholdings from 177.136.227.147 port 37654


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 05:45:28 host2 sshd[2468722]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.213.99.113
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 73.213.99.113 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.98.49.213
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.98.49.213 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.179.109.220
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.179.109.220 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.124.171.102
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.124.171.102 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.195.176.125
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.195.176.125 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.29.177
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.59.29.177 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.67.92.235
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.67.92.235 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.60.224
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.49.60.224 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.56.125.66
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 134.56.125.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.28.75
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.56.28.75 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.208.198.114
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.208.198.114 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.15.82.173
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.15.82.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.62.126.65
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.62.126.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.68.123
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.162.68.123 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.248.184.177
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 192.248.184.177 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-07 06:03:52 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (metryng) [68.46.148.180]:56688: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Nov  7 06:04:54 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aku0WfZCztbG6xjJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.22.235.252
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.22.235.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.234.131.51
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.234.131.51 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.10.83.100
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.10.83.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.225.51.16
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 97.225.51.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.167.9.98
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.167.9.98 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.249.241
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.56.249.241 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.162.143
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 169.150.162.143 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov  7 06:12:57 host2 sshd[2501201]: Disconnected from invalid user ubuntu 104.168.4.151 port 32978 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.46.233
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 35.150.46.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.103.5
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 12.74.103.5 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.2.36.89
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 99.2.36.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.217.27.247
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.217.27.247 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.225.60.69
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.225.60.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.20.2.128
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.20.2.128 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.248.63.126
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.248.63.126 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov  7 06:15:56 host2 sshd[2504839]: Disconnected from invalid user alex 104.168.4.151 port 33264 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov  7 06:17:00 host2 sshd[2506163]: User agentallianz from 152.53.188.144 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.189.33
country_id: 6251999
description:
Nov  7 06:17:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.189.33, lip=66.85.158.91, session=<CwPXhvZCyKCUcb0h>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.4.151
country_id: 6252001
description:
Nov  7 06:18:15 host2 sshd[2507486]: Disconnected from invalid user git 104.168.4.151 port 33518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.99
country_id: 1880251
description:
Nov  7 06:18:28 host2 sshd[2507654]: Disconnected from invalid user chenlei 45.78.219.99 port 60536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov  7 06:20:22 host2 sshd[2509918]: Disconnected from invalid user sdn 104.168.4.151 port 33764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov  7 06:21:34 host2 sshd[2511368]: Disconnected from invalid user batman 104.168.4.151 port 33890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  7 06:21:34 host2 sshd[2511373]: Invalid user secondcoffeeinternational from 43.225.52.249 port 46268


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.119.233
country_id: 798544
description:
Nov  7 06:23:19 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=176.98.119.233, lip=66.85.158.91, TLS, session=<ImmSmvZC0cmwYnfp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.220
country_id: 3469034
description:
Nov  7 06:23:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.255.206.220, lip=66.85.158.91, TLS, session=<hdW+m/ZCjYuK/87c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-07 06:28:26 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:41233: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-07 06:28:47 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:33400: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.232.73.84
country_id: 3469034
description:
Nov  7 06:29:39 host2 sshd[2519805]: Disconnected from invalid user maint 45.232.73.84 port 55982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-07 06:30:20 dovecot_login authenticator failed for ([46.149.83.62]) [46.149.83.62]:37070: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-07 06:30:29 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:38938: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 06:30:55 host2 sshd[2521318]: Disconnected from invalid user howard 62.60.131.157 port 44158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Nov  7 06:31:03 host2 sshd[2521671]: Disconnected from invalid user ftpuser 45.232.73.84 port 56244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-11-07 06:31:39 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:35175: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.23.177
country_id: 1819730
description:
Nov  7 06:31:48 host2 pure-ftpd[2522367]: (?@165.154.23.177) [INFO] New connection from 165.154.23.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-11-07 06:32:17 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:54012: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Nov  7 06:32:24 host2 sshd[2522941]: Disconnected from invalid user ctf 45.232.73.84 port 56504 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.213.113
country_id: 1819730
description:
Nov  7 06:35:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=152.32.213.113, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<juG9x/ZCvn+YINVx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 06:36:11 host2 sshd[2526980]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Nov  7 06:46:36 host2 sshd[2538741]: Disconnected from invalid user bitwarden 206.81.27.245 port 50048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-11-07 06:46:44 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:33931: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-11-07 06:47:16 dovecot_login authenticator failed for ([49.124.155.162]) [49.124.155.162]:51212: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.99
country_id: 1880251
description:
Nov  7 06:52:46 host2 sshd[2545703]: Disconnected from invalid user sdn 45.78.219.99 port 42402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Nov  7 06:52:58 host2 sshd[2545924]: Disconnected from invalid user surya 206.81.27.245 port 50286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.81.27.245
country_id: 2921044
description:
Nov  7 06:54:59 host2 sshd[2548394]: Disconnected from invalid user unity 206.81.27.245 port 39170 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.160.210
country_id: 2921044
description:
Nov  7 06:56:17 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.160.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FltuEfdCsKOkXKDS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.99
country_id: 1880251
description:
Nov  7 07:00:35 host2 sshd[2554426]: Disconnected from invalid user ventas 45.78.219.99 port 52794 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  7 07:05:07 host2 sshd[2559566]: User agentallianz from 156.238.224.82 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 07:09:26 host2 sshd[2564257]: Disconnected from invalid user user 2.57.121.25 port 18975 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.134.212
country_id: 2921044
description:
Nov  7 07:10:51 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=139.59.134.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wZeFRfdCVMGLO4bU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.99
country_id: 1880251
description:
Nov  7 07:11:07 host2 sshd[2566025]: Disconnected from invalid user server 45.78.219.99 port 51010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.212
country_id: 6252001
description:
Nov  7 07:12:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.212, lip=66.85.158.91, TLS: Connection closed, session=<5irOTPdCvcvDuEzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.137
country_id: 6252001
description:
Nov  7 07:12:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RD2KS/dCF8LDuEyJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.23
country_id: 1605651
description:
Nov  7 07:12:31 host2 pure-ftpd[2567780]: (?@103.176.152.23) [INFO] New connection from 103.176.152.23


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.138
country_id: 6252001
description:
Nov  7 07:12:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.138, lip=66.85.158.91, TLS: Connection closed, session=<NjQnTPdCk8DDuEyK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.142
country_id: 6252001
description:
Nov  7 07:12:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.142, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<UTafTPdC15HDuEyO>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.99.142.38
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.99.142.38 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.150.249.64
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.150.249.64 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.125.236.88
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.125.236.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.29.4.12
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 76.29.4.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.220.79
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.141.220.79 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.150.240
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.58.150.240 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.35.210.47
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.35.210.47 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 07:20:59 host2 sshd[2577247]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov  7 07:22:06 host2 sshd[2578755]: Disconnected from invalid user nigger 107.172.15.139 port 36550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.163
country_id: 6252001
description:
Nov  7 07:23:47 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dpbPc/dC3s3G6xij>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-11-07 07:24:21 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:36027: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov  7 07:24:44 host2 sshd[2581288]: Disconnected from invalid user testuser 102.214.200.110 port 34798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov  7 07:25:28 host2 sshd[2582185]: Disconnected from invalid user wan 107.172.15.139 port 56912 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.15.139
country_id: 6252001
description:
Nov  7 07:27:05 host2 sshd[2583880]: Disconnected from invalid user reelftptv 107.172.15.139 port 58498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov  7 07:26:29 host2 sshd[2583168]: Disconnected from invalid user kevin 102.214.200.110 port 34702 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  7 07:26:46 host2 sshd[2583603]: User agentallianz from 103.84.173.178 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.204.32
country_id: 6251999
description:
Nov  7 07:27:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.204.32, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9asXgPdCRpeAy8wg>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov  7 07:27:22 host2 sshd[2584174]: User agentallianz from 64.23.244.39 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov  7 07:28:11 host2 sshd[2584974]: Disconnected from invalid user git 102.214.200.110 port 58890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-07 07:28:28 dovecot_plain authenticator failed for (psinabilis) [46.8.240.26]:44754: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.208.158
country_id: 6252001
description:
Nov  7 07:29:33 host2 pure-ftpd[2586514]: (?@146.190.208.158) [INFO] New connection from 146.190.208.158


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.198
country_id: 6252001
description:
Nov  7 07:31:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.23.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MJwKjvdCsJ0UHRfG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov  7 07:33:37 host2 sshd[2591661]: Disconnected from invalid user amir 107.172.15.139 port 45220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.214.200.110
country_id: 953987
description:
Nov  7 07:34:31 host2 sshd[2592767]: Disconnected from invalid user mine 102.214.200.110 port 47950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.209.57
country_id: 174982
description:
2025-11-07 07:34:52 dovecot_login authenticator failed for (host-57.209.77.5.ucom.am) [5.77.209.57]:38379: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-11-07 07:36:01 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (astessores) [73.144.27.228]:52972: 535 Incorrect authentication data (set_id=sales@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-07 07:36:05 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (matesid) [73.196.144.25]:49220: 535 Incorrect authentication data (set_id=sales@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.100
country_id: 6252001
description:
Nov  7 07:37:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.100, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V2S3pfdCV8mTuYRk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.246.42.72
country_id: 1269750
description:
Nov  7 07:39:54 host2 sshd[2599592]: Disconnected from invalid user jason 103.246.42.72 port 55010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov  7 07:41:15 host2 sshd[2601153]: Disconnected from invalid user otrs 92.191.96.115 port 40570 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.126.43.181
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 50.126.43.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.4.221.233
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 172.4.221.233 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.38.30.225
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.38.30.225 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.44.173
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.32.44.173 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.104.114.104
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.104.114.104 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.81.219.193
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 67.81.219.193 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.138.47.49
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.138.47.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov  7 07:43:16 host2 sshd[2603110]: Disconnected from invalid user gituser 123.58.212.64 port 53538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov  7 07:44:05 host2 sshd[2603927]: Disconnected from invalid user lea 92.191.96.115 port 61152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.246.42.72
country_id: 1269750
description:
Nov  7 07:44:56 host2 sshd[2604787]: Disconnected from invalid user user 103.246.42.72 port 45478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov  7 07:45:22 host2 sshd[2605641]: Disconnected from invalid user test 92.191.96.115 port 63390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov  7 07:46:38 host2 sshd[2607308]: Disconnected from invalid user syncthing 92.191.96.115 port 55580 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Nov  7 07:47:53 host2 sshd[2608654]: Disconnected from invalid user test 92.191.96.115 port 2280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-11-07 07:48:53 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:51395: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov  7 07:49:51 host2 sshd[2610640]: Disconnected from invalid user derek 123.58.212.64 port 59890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-11-07 07:49:19 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:52895: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.220.68.114
country_id: 51537
description:
Nov  7 07:50:18 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=197.220.68.114, lip=66.85.158.91, TLS, session=<PTOQ0fdCRbnF3ERy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.255.183.126
country_id: 3865483
description:
Nov  7 07:50:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=131.255.183.126, lip=66.85.158.91, TLS, session=<QtPX0vdC6rOD/7d+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.246.42.72
country_id: 1269750
description:
Nov  7 07:51:53 host2 sshd[2613233]: Disconnected from invalid user radu 103.246.42.72 port 48114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov  7 07:52:27 host2 sshd[2613810]: Disconnected from invalid user deployer 123.58.212.64 port 35304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.187
country_id: 953987
description:
Nov  7 08:03:25 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.64.41.187, lip=66.85.158.91, TLS, session=</hldAPhCjsRmQCm7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-07 08:03:35 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:59213: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.95
country_id: 3469034
description:
Nov  7 08:03:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.120.72.95, lip=66.85.158.91, TLS, session=<YTayAfhCAOy7eEhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-07 08:05:13 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:39194: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-07 08:05:30 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:51287: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  7 08:09:31 host2 sshd[2632836]: Invalid user agronatureholdings from 177.136.227.147 port 34696


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov  7 08:11:19 host2 sshd[2635106]: Disconnected from invalid user louis 197.5.145.150 port 60974 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.196.31
country_id: 6252001
description:
Nov  7 08:17:16 host2 pure-ftpd[2641211]: (?@20.106.196.31) [INFO] New connection from 20.106.196.31


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov  7 08:17:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<mWeHM/hChM82rEyT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov  7 08:18:22 host2 sshd[2642245]: Disconnected from invalid user appuser 197.5.145.150 port 50832 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.150
country_id: 2464461
description:
Nov  7 08:20:45 host2 sshd[2644801]: Disconnected from invalid user geoserver 197.5.145.150 port 43808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov  7 08:21:54 host2 sshd[2646125]: Disconnected from invalid user debian 197.5.145.150 port 46436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov  7 08:23:07 host2 sshd[2647360]: Disconnected from invalid user marco 197.5.145.150 port 44490 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Nov  7 08:22:57 host2 pure-ftpd[2647160]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  7 08:26:55 host2 sshd[2651319]: User agentallianz from 67.217.244.159 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-07 08:27:03 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:54760: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.117.124
country_id: 6252001
description:
Nov  7 08:31:30 host2 pure-ftpd[2656051]: (?@172.202.117.124) [INFO] New connection from 172.202.117.124


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov  7 08:35:17 host2 sshd[2660002]: User agentallianz from 152.53.188.144 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  7 08:35:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<jrLvcvhCcsw+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-11-07 08:41:03 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:51394: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.253
country_id: 1733045
description:
2025-11-07 08:40:31 dovecot_login authenticator failed for ([49.124.150.253]) [49.124.150.253]:47058: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  7 08:41:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<7brsiPhCWuA+PIOL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.223.188.90
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 111.223.188.90 - anandaob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User anandaob has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-07 08:57:54 dovecot_plain authenticator failed for (epaling) [65.20.160.107]:51366: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.176
country_id: 953987
description:
Nov  7 08:58:45 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.64.34.176, lip=66.85.158.91, TLS, session=<pk5PxvhC0txmQCKw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.124
country_id: 3175395
description:
Nov  7 08:59:03 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.124, lip=66.85.158.91, TLS, session=<PA+Lx/hCbuLZGrN8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Nov  7 08:59:50 host2 sshd[2689670]: Disconnected from invalid user ubuntu 5.182.83.231 port 34814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-11-07 09:00:19 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:46472: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-07 09:00:34 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:53700: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov  7 09:02:11 host2 sshd[2692872]: Disconnected from invalid user cc 5.182.83.231 port 59110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-07 09:03:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62110: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov  7 09:04:31 host2 sshd[2696238]: Disconnected from invalid user nw 5.182.83.231 port 45624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov  7 09:05:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<gROq4PhCyKmSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov  7 09:05:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<+Lt/3/hCYJyYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 09:07:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<lC+j5fhCQucrh5l8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov  7 09:08:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<BjFj6/hClp2YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 09:08:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<sx3I6/hCcr0v+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.245.108.234
country_id: 1269750
description:
Nov  7 09:09:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=157.245.108.234, lip=66.85.158.91, session=<1iBm7vhCMtKd9Wzq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.57.222
country_id: 2921044
description:
Nov  7 09:09:57 host2 sshd[2702246]: Disconnected from invalid user postmaster 34.159.57.222 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.3
country_id: 1605651
description:
Nov  7 09:09:59 host2 sshd[2702262]: Disconnected from invalid user auction 27.254.235.3 port 57130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 09:09:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<ZdnX7fhCqqXRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 09:10:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<5QMZ8vhCGsJK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 09:10:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<IyMt8fhCkXcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Nov  7 09:10:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<yud78fhCsNMI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 09:10:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1CuD8fhCHOQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 09:11:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<7TbZ9PhCcIWLO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.159.57.222
country_id: 2921044
description:
Nov  7 09:14:11 host2 sshd[2706895]: Disconnected from invalid user hadoop1 34.159.57.222 port 37204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov  7 09:14:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<ycg4//hCWqmYNbyQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.3
country_id: 1605651
description:
Nov  7 09:14:38 host2 sshd[2707453]: Disconnected from invalid user webapp 27.254.235.3 port 44360 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.51
country_id: 6252001
description:
Nov  7 09:15:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.51, lip=66.85.158.91, session=<F1IOBPlCgPuTuYQz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 09:15:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<pypNBPlCFMvBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 09:17:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<jeJHCvlCvM1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov  7 09:19:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<KaMvE/lCNhinYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Nov  7 09:20:04 host2 sshd[2713152]: Disconnected from invalid user ubuntu 34.78.29.97 port 57330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.105.5.106
country_id: 298795
description:
Nov  7 09:19:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=194.105.5.106, lip=66.85.158.91, session=<fwXEEPlCsK/CaQVq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 09:19:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<SZPcEvlCINfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 09:20:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<mmo3FflCyoov7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.3
country_id: 1605651
description:
Nov  7 09:20:37 host2 sshd[2713687]: Disconnected from invalid user deploybot 27.254.235.3 port 57190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 09:20:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<aGm1FPlChNCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.247.148.92
country_id: 1269750
description:
Nov  7 09:20:30 host2 sshd[2713623]: Disconnected from invalid user MC 4.247.148.92 port 44718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Nov  7 09:21:26 host2 sshd[2714561]: Disconnected from invalid user hydra 34.78.29.97 port 48290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov  7 09:21:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<1OjhGPlC3Jwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 09:21:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<kUz0GflCcsNn9Sd0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.235.3
country_id: 1605651
description:
Nov  7 09:22:33 host2 sshd[2715779]: Disconnected from invalid user steam 27.254.235.3 port 33228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Nov  7 09:22:42 host2 sshd[2715958]: Disconnected from invalid user eddie 34.78.29.97 port 38812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.255
country_id: 1880251
description:
Nov  7 09:24:21 host2 sshd[2717881]: Disconnected from invalid user ubuntu 101.47.143.255 port 48862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.78.29.97
country_id: 2802361
description:
Nov  7 09:25:04 host2 sshd[2718683]: Disconnected from invalid user ubuntu 34.78.29.97 port 34976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.247.148.92
country_id: 1269750
description:
Nov  7 09:25:18 host2 sshd[2719001]: Disconnected from invalid user justin 4.247.148.92 port 41568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  7 09:28:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<LFeYMflCaL4+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.78.29.97
country_id: 2802361
description:
Nov  7 09:28:46 host2 sshd[2722671]: Disconnected from invalid user user19 34.78.29.97 port 45740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 09:29:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<i2m9M/lC5sQv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 09:29:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<TVyCNflCLNEv+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov  7 09:31:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<d29YO/lCNKIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Nov  7 09:31:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<tRRHPflChg0I3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov  7 09:33:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ZJV8QvlCCp+nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.255
country_id: 1880251
description:
Nov  7 09:34:50 host2 sshd[2729253]: Disconnected from invalid user fengyun 101.47.143.255 port 38922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Nov  7 09:36:07 host2 sshd[2731008]: Disconnected from invalid user MC 107.174.55.72 port 35776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.189.126.6
country_id: 337996
description:
Nov  7 09:39:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=196.189.126.6, lip=66.85.158.91, session=<nn+fWflCKLjEvX4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 09:40:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<+cdaXflClrc5gL/H>


