# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.108.92.15
country_id: 1643084
description:
Nov 28 04:43:27 host2 sshd[1356581]: Disconnected from invalid user user 149.108.92.15 port 45606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov 28 04:44:12 host2 sshd[1357077]: Disconnected from invalid user user 101.36.122.23 port 55408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 28 04:44:18 host2 sshd[1357192]: Disconnected from invalid user remote 40.117.97.0 port 52722 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.108.92.15
country_id: 1643084
description:
Nov 28 04:44:42 host2 sshd[1357480]: Disconnected from invalid user backend 149.108.92.15 port 51076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Nov 28 04:44:47 host2 sshd[1357539]: Disconnected from invalid user superadmin 118.193.35.17 port 55758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:44:29 host2 sshd[1357277]: Disconnected from invalid user radarr 45.147.46.233 port 34418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 28 04:44:54 host2 sshd[1357712]: Disconnected from invalid user tmp 116.193.191.159 port 48976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov 28 04:45:22 host2 sshd[1358511]: Disconnected from invalid user debian 101.36.122.23 port 36944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 28 04:46:01 host2 sshd[1359046]: Disconnected from invalid user nextcloud 116.193.191.159 port 52036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 04:46:05 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62650: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.123.61
country_id: 2921044
description:
Nov 28 04:45:26 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.226.123.61, lip=66.85.158.92, session=<wegtsJtECOpA4ns9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 28 04:45:31 host2 sshd[1358604]: Disconnected from invalid user debian 40.117.97.0 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:45:43 host2 sshd[1358718]: Disconnected from invalid user angel 101.36.107.103 port 54938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:46:15 host2 sshd[1359229]: Disconnected from invalid user backend 104.168.94.22 port 38902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-28 04:46:16 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:47294: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-28 04:46:35 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:40270: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.246
country_id: 1880251
description:
Nov 28 04:46:36 host2 sshd[1359419]: Disconnected from invalid user nextcloud 45.78.204.246 port 33318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:48:07 host2 sshd[1360357]: Disconnected from invalid user devuser 101.36.107.103 port 50468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:47:21 host2 sshd[1359919]: Disconnected from invalid user share 104.168.94.22 port 37986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:48:18 host2 sshd[1360463]: Disconnected from invalid user dixi 45.147.46.233 port 50790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:48:27 host2 sshd[1360530]: Disconnected from invalid user abhi 104.168.94.22 port 37076 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 158.94.210.79 - admin "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:49:59 host2 sshd[1361369]: Disconnected from invalid user share 45.147.46.233 port 48072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:50:27 host2 sshd[1361878]: Disconnected from invalid user anaconda 101.36.107.103 port 47334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Nov 28 04:50:46 host2 sshd[1362075]: Disconnected from invalid user ubuntu 189.50.142.82 port 60688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 04:51:21 host2 sshd[1362667]: Disconnected from invalid user  2.57.121.112 port 62120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.246
country_id: 1880251
description:
Nov 28 04:51:42 host2 sshd[1362854]: Disconnected from invalid user debian 45.78.204.246 port 46244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:53:11 host2 sshd[1363850]: Disconnected from invalid user sens 45.147.46.233 port 52482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.246
country_id: 1880251
description:
Nov 28 04:59:15 host2 sshd[1368860]: Disconnected from invalid user devuser 45.78.204.246 port 47682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 28 05:02:23 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<NNTM7JtEVjFChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.125.10
country_id: 3573591
description:
2025-11-28 05:06:45 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [181.188.125.10]:45605: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Nov 28 05:16:38 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oa66H5xEhFdChJmJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 28 05:20:36 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<5qHULZxEsJuSOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-28 05:22:11 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:52561: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-28 05:22:57 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:40285: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 28 05:30:01 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, session=<RN2eT5xEkumUcd3D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.19.215
country_id: 1269750
description:
Nov 28 05:32:27 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.164.19.215, lip=66.85.158.91, TLS, session=<w64YV5xE6ORnpBPX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.23
country_id: 99237
description:
Nov 28 05:32:50 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=65.20.213.23, lip=66.85.158.91, TLS, session=<tK5+WJxEnZFBFNUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:36:30 host2 sshd[1391420]: Disconnected from invalid user es 172.208.48.177 port 58906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:38:28 host2 sshd[1392621]: Disconnected from invalid user wordpress 117.250.96.66 port 60536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:38:11 host2 sshd[1392476]: Disconnected from invalid user terraria 172.208.48.177 port 44014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:39:25 host2 sshd[1393348]: Disconnected from invalid user techuser 172.208.48.177 port 58484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:40:40 host2 sshd[1394547]: Disconnected from invalid user vagrant 172.208.48.177 port 54952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:41:54 host2 sshd[1395419]: Disconnected from invalid user wordpress 172.208.48.177 port 48182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Nov 28 05:42:07 host2 sshd[1395573]: Disconnected from invalid user mark 199.195.254.215 port 44728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-28 05:43:29 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:35372: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.254.215
country_id: 6252001
description:
Nov 28 05:43:39 host2 sshd[1396652]: Disconnected from invalid user wordpress 199.195.254.215 port 43390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-28 05:43:52 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:55096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 05:44:31 host2 sshd[1397220]: Disconnected from invalid user ellis 62.60.131.157 port 39527 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:44:40 host2 sshd[1397433]: Disconnected from invalid user mapr 117.250.96.66 port 38172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.178
country_id: 6252001
description:
Nov 28 05:46:14 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.12.240.178, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<t/SdiZxEgtIUDPCy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:52:42 host2 sshd[1402494]: Disconnected from invalid user vagrant 117.250.96.66 port 45528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:54:21 host2 sshd[1403682]: Disconnected from invalid user test123 117.250.96.66 port 46998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:55:51 host2 sshd[1405014]: Disconnected from invalid user techuser 117.250.96.66 port 48472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 05:57:30 host2 sshd[1405974]: Disconnected from invalid user terraria 14.139.216.56 port 49946 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.234
country_id: 6252001
description:
Nov 28 05:57:43 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.234, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tQ2lspxEItcUQGnq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:00:46 host2 sshd[1408207]: Disconnected from invalid user ali 14.139.216.56 port 52890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:02:20 host2 sshd[1409788]: Disconnected from invalid user tony 14.139.216.56 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:07:14 host2 sshd[1413470]: Disconnected from invalid user carlos 14.139.216.56 port 58786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:10:26 host2 sshd[1415789]: Disconnected from invalid user kyt 14.139.216.56 port 33498 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.61
country_id: 6252001
description:
Nov 28 06:13:10 host2 pure-ftpd[1417592]: (?@167.94.146.61) [INFO] New connection from 167.94.146.61


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov 28 06:13:59 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KPbc7JxEqsDG6xjP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 06:17:45 host2 sshd[1420476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-28 06:18:26 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (etteanymed) [98.204.134.124]:44248: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 06:25:05 host2 sshd[1425084]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:27:47 host2 sshd[1426739]: Disconnected from invalid user jacob 162.241.127.152 port 60026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:31:44 host2 sshd[1429082]: Disconnected from invalid user minecraft 162.241.127.152 port 33782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 06:32:14 host2 sshd[1429320]: Disconnected from invalid user  2.57.121.112 port 62088 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:32:47 host2 sshd[1429590]: Disconnected from invalid user devops 162.241.127.152 port 32994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-28 06:32:51 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:52245: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-28 06:33:24 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53394: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:33:49 host2 sshd[1430293]: Disconnected from invalid user sales1 162.241.127.152 port 60436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Nov 28 06:34:42 host2 sshd[1430906]: Disconnected from invalid user guest123 103.164.9.82 port 36394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:34:51 host2 sshd[1431059]: Disconnected from invalid user gitea 162.241.127.152 port 59646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.4
country_id: 6252001
description:
Nov 28 06:38:40 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.4, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<W6ImRZ1E77jDuEwE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-28 06:38:21 dovecot_plain authenticator failed for (poyed) [94.201.22.158]:46573: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.231
country_id: 6252001
description:
Nov 28 06:38:22 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GjkURJ1E04LDuEzn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.230
country_id: 6252001
description:
Nov 28 06:38:33 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.230, lip=66.85.158.91, TLS: Connection closed, session=<bFa2RJ1Eg63DuEzm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.0
country_id: 6252001
description:
Nov 28 06:38:44 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.0, lip=66.85.158.91, TLS: Connection closed, session=<HG1VRZ1ExbPDuEwA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.9.82
country_id: 1168579
description:
Nov 28 06:38:45 host2 sshd[1435648]: Disconnected from invalid user es 103.164.9.82 port 58324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-28 06:39:24 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (divereopic) [68.82.141.145]:57040: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Nov 28 06:40:03 host2 sshd[1437138]: Disconnected from invalid user bodega 103.164.9.82 port 60078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.91.151
country_id: 2921044
description:
Nov 28 06:43:45 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.91.151, lip=66.85.158.92, TLS, session=<weBTV51ExL1A4luX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:46:37 host2 sshd[1445401]: Disconnected from invalid user osboxes 34.66.72.251 port 52554 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.241
country_id: 3469034
description:
Nov 28 06:47:39 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2>, method=PLAIN, rip=186.209.251.241, lip=66.85.158.91, TLS, session=<98MrZJ1E1re60fvx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.15.67
country_id: 3469034
description:
Nov 28 06:47:19 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=186.236.15.67, lip=66.85.158.91, TLS, session=<xwvzYp1EcK+67A9D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:48:49 host2 sshd[1448438]: Disconnected from invalid user builder 34.66.72.251 port 45788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 28 06:48:20 host2 sshd[1447758]: Disconnected from invalid user redmine 165.227.3.79 port 50978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.251
country_id: 3469034
description:
Nov 28 06:48:25 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.53.165.251, lip=66.85.158.91, TLS, session=<yfaiZp1EW+SxNaX7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.105.4
country_id: 3469034
description:
Nov 28 06:48:44 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=187.120.105.4, lip=66.85.158.91, TLS, session=<hYgVaJ1E8tW7eGkE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:48:18 host2 sshd[1447678]: Disconnected from invalid user victor 43.252.229.25 port 41434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:49:57 host2 sshd[1449690]: Disconnected from invalid user dbadmin 34.66.72.251 port 54028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Nov 28 06:49:14 host2 sshd[1448932]: Disconnected from invalid user andres 103.82.240.194 port 55476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:49:37 host2 sshd[1449341]: Disconnected from invalid user elemental 43.252.229.25 port 40874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-11-28 06:49:56 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (nopister) [5.185.233.251]:59596: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 28 06:50:08 host2 sshd[1450021]: Disconnected from invalid user vtatis 50.84.211.204 port 49424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:51:05 host2 sshd[1451256]: Disconnected from invalid user user 34.66.72.251 port 51248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:51:55 host2 sshd[1452125]: Disconnected from invalid user qiyuesuo 43.252.229.25 port 38316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 28 06:52:57 host2 sshd[1453218]: Disconnected from invalid user qiyuesuo 165.227.3.79 port 48031 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:53:06 host2 sshd[1453426]: Disconnected from invalid user temp 43.252.229.25 port 37024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 28 06:53:20 host2 sshd[1453731]: Disconnected from invalid user huawei 50.84.211.204 port 45996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 28 06:54:54 host2 sshd[1455787]: Disconnected from invalid user test01 165.227.3.79 port 45129 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov 28 06:54:23 host2 sshd[1454867]: Disconnected from invalid user gns3 101.47.140.146 port 46280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-28 06:56:31 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (kansubte) [98.192.114.251]:38941: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.122.105.182
country_id: 6252001
description:
Nov 28 06:59:45 host2 pure-ftpd[1461235]: (?@34.122.105.182) [INFO] New connection from 34.122.105.182


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.157.252
country_id: 2635167
description:
Nov 28 07:00:46 host2 sshd[1462332]: Disconnected from invalid user ir 92.27.157.252 port 39204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.157.252
country_id: 2635167
description:
Nov 28 07:03:42 host2 sshd[1465478]: Disconnected from invalid user ubuntu 92.27.157.252 port 35913 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.27.157.252
country_id: 2635167
description:
Nov 28 07:04:51 host2 sshd[1466526]: Disconnected from invalid user mike 92.27.157.252 port 51206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov 28 07:05:11 host2 sshd[1466641]: Disconnected from invalid user administrator 101.47.140.146 port 52942 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.167
country_id: 2635167
description:
Nov 28 07:05:45 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.167, lip=66.85.158.92, session=<sSn/pZ1EcPcjy9On>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.82
country_id: 6252001
description:
Nov 28 07:06:39 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.82, lip=66.85.158.92, session=<+SoxqZ1EsPSTuYRS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-28 07:11:16 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (trastspose) [85.225.19.144]:44038: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.124.166
country_id: 6252001
description:
Nov 28 07:14:18 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.76.124.166, lip=66.85.158.91, session=<ibWOxJ1EDoYoTHym>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.82
country_id: 1880251
description:
Nov 28 07:15:03 host2 sshd[1475324]: Disconnected from invalid user jacob 101.47.140.82 port 35994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:15:39 host2 sshd[1475874]: Disconnected from invalid user daniel 103.145.145.75 port 50328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.31
country_id: 6252001
description:
Nov 28 07:18:38 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.31, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5I4H1J1EFI0UQGgf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:21:07 host2 sshd[1479692]: Disconnected from invalid user abhi 103.145.145.75 port 34444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:22:19 host2 sshd[1480262]: Disconnected from invalid user vps 103.145.145.75 port 33048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:24:39 host2 sshd[1481579]: Disconnected from invalid user aaa 103.145.145.75 port 58496 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.81
country_id: 6252001
description:
Nov 28 07:26:58 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.81, lip=66.85.158.92, session=<3gvb8Z1EqoYUQGlR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.83.190
country_id: 6252001
description:
Nov 28 07:29:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.169.83.190, lip=66.85.158.91, session=<n1+m+p1EoIQUqVO+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 28 07:29:30 host2 sshd[1484189]: Disconnected from invalid user userb 168.194.164.218 port 43196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.1.211
country_id: 6252001
description:
Nov 28 07:31:05 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.1.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cT6bAJ5EgIwUowHT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-11-28 07:32:40 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:51766: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-28 07:32:15 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:57700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 28 07:32:30 host2 sshd[1485896]: Disconnected from invalid user aaa 168.194.164.218 port 58672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 28 07:33:11 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BlcbCJ5EuPi4affE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 28 07:35:33 host2 sshd[1487916]: Disconnected from invalid user vps 168.194.164.218 port 45430 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.124
country_id: 1880251
description:
Nov 28 07:43:52 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=15.235.175.124, lip=66.85.158.92, session=<9Y5GLp5E/+YP6698>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.121
country_id: 1880251
description:
Nov 28 07:44:06 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=15.235.175.121, lip=66.85.158.92, session=<8GQcL55ERZwP6695>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-28 07:44:53 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (aphiper) [24.91.103.202]:35940: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-11-28 07:44:48 dovecot_plain authenticator failed for dsl540122f2.fixip.t-online.hu (pallatt) [84.1.34.242]:58610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.111.158
country_id: 1168579
description:
Nov 28 07:45:25 host2 sshd[1494665]: Disconnected from invalid user testuser 103.76.111.158 port 59794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.111.158
country_id: 1168579
description:
Nov 28 07:50:25 host2 sshd[1498333]: Disconnected from invalid user ubuntu 103.76.111.158 port 45694 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.125.17
country_id: 6252001
description:
Nov 28 07:50:15 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.76.125.17, lip=66.85.158.92, session=<eScfRZ5EGq8oTH0R>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.111.158
country_id: 1168579
description:
Nov 28 07:51:50 host2 sshd[1499100]: Disconnected from invalid user debian 103.76.111.158 port 34420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.65
country_id: 6252001
description:
Nov 28 07:57:31 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.65, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sq0dX55Et9bG6xhB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-28 08:00:07 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (reylepas) [81.225.30.107]:57469: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.95.10
country_id: 1880251
description:
Nov 28 08:02:37 host2 sshd[1505518]: Disconnected from invalid user joe 47.237.95.10 port 39978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 08:03:33 host2 sshd[1506587]: Disconnected from invalid user admin 2.57.121.112 port 36573 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 08:09:53 host2 sshd[1510743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 08:17:13 host2 sshd[1515136]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.51.190
country_id: 2921044
description:
Nov 28 08:21:15 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=8.211.51.190, lip=66.85.158.91, session=<TWP3s55EMtAI0zO+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 144.31.90.241
country_id: 660013
description:
Nov 28 08:22:49 host2 pure-ftpd[1518251]: (?@144.31.90.241) [INFO] New connection from 144.31.90.241


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 28 08:23:53 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<2cdlvZ5EdsgDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 08:24:03 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64824: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.115
country_id: 6252001
description:
Nov 28 08:24:34 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.115, lip=66.85.158.91, TLS, session=<YZ3fv55EIMEofK1z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.140.134.46
country_id: 2413451
description:
2025-11-28 08:31:28 dovecot_plain authenticator failed for (X58MAJ152S6) [102.140.134.46]:52506: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-11-28 08:31:48 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:56135: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-28 08:32:22 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:59862: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.82.240.10
country_id: 1643084
description:
Nov 28 08:35:06 host2 sshd[1525186]: Disconnected from invalid user kevin 119.82.240.10 port 16661 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 28 08:36:35 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<GwLV6p5EwLssyhQX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.82.240.10
country_id: 1643084
description:
Nov 28 08:36:28 host2 sshd[1525984]: Disconnected from invalid user tidb 119.82.240.10 port 49202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.121.32
country_id: 6252001
description:
Nov 28 08:37:30 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.121.32, lip=66.85.158.92, TLS, session=<BLgf7p5EOLgNWXkg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.82.240.10
country_id: 1643084
description:
Nov 28 08:37:47 host2 sshd[1526837]: Disconnected from invalid user t3rr0r 119.82.240.10 port 12004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:37:55 host2 sshd[1526887]: Disconnected from invalid user deamon 52.237.80.79 port 57968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:38:39 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<J1ow8p5EbucDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:39:21 host2 sshd[1527811]: Disconnected from invalid user user 186.10.86.130 port 39242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:39:43 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5foH9p5EipMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.51.100.133
country_id: 1269750
description:
2025-11-28 08:39:46 dovecot_plain authenticator failed for (CHXEI8NX18) [157.51.100.133]:50123: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:40:26 host2 sshd[1528554]: Disconnected from invalid user tv 186.10.86.130 port 49136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 28 08:40:46 host2 sshd[1528728]: Disconnected from invalid user soporte 27.112.78.245 port 52750 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:40:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PgqT+J5EMu0DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 28 08:41:11 host2 sshd[1528969]: Disconnected from invalid user aj 156.245.239.180 port 52858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:41:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<GyYw/J5EMpsDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:42:35 host2 sshd[1529959]: Disconnected from invalid user roland 186.10.86.130 port 35992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:42:54 host2 sshd[1530215]: Disconnected from invalid user local 52.237.80.79 port 45386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:42:27 host2 sshd[1529865]: Disconnected from invalid user desliga 159.65.11.28 port 39964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.245.239.180
country_id: 241170
description:
Nov 28 08:42:29 host2 sshd[1529880]: Disconnected from invalid user thomas 156.245.239.180 port 52978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:43:54 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<aaT3BJ9ErNkDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 28 08:43:55 host2 sshd[1530918]: Disconnected from invalid user sales1 156.245.239.180 port 36520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:44:19 host2 sshd[1531209]: Disconnected from invalid user user1 52.237.80.79 port 37086 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:44:54 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<zIGVCJ9EQLMDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:45:41 host2 sshd[1533212]: Disconnected from invalid user kevin 52.237.80.79 port 36926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:45:46 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<T8apC59EhNEDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 28 08:45:58 host2 sshd[1533623]: Disconnected from invalid user gitlab 27.112.78.245 port 34880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.241.103
country_id: 1269750
description:
Nov 28 08:46:35 host2 sshd[1534718]: Disconnected from invalid user userb 103.39.241.103 port 37944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.189.122
country_id: 3996063
description:
Nov 28 08:46:45 host2 sshd[1534917]: Disconnected from invalid user user 201.103.189.122 port 57404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:47:23 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dUt2EZ9E4LADiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:47:52 host2 sshd[1535971]: Disconnected from invalid user docker 186.10.86.130 port 49026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:48:41 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<grQdFp9EKJYDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:48:38 host2 sshd[1536633]: Disconnected from invalid user autrede 159.65.11.28 port 34906 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 28 08:49:22 host2 sshd[1537057]: Disconnected from invalid user docker 27.112.78.245 port 55960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.241.103
country_id: 1269750
description:
Nov 28 08:49:39 host2 sshd[1537239]: Disconnected from invalid user frappe 103.39.241.103 port 37004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.189.122
country_id: 3996063
description:
Nov 28 08:50:44 host2 sshd[1538029]: Disconnected from invalid user support 201.103.189.122 port 33268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:50:49 host2 sshd[1538076]: Disconnected from invalid user valheim 159.65.11.28 port 34144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-28 08:51:05 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (etintiniet) [196.47.172.253]:43749: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.189.16
country_id: 2658434
description:
Nov 28 08:52:08 host2 pure-ftpd[1538949]: (?@35.216.189.16) [INFO] New connection from 35.216.189.16


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.189.16
country_id: 2658434
description:
Nov 28 08:52:11 host2 pure-ftpd[1538996]: (?@35.216.189.16) [INFO] New connection from 35.216.189.16


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.189.16
country_id: 2658434
description:
Nov 28 08:52:13 host2 pure-ftpd[1539013]: (?@35.216.189.16) [INFO] New connection from 35.216.189.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:53:00 host2 sshd[1539491]: Disconnected from invalid user runner 159.65.11.28 port 42838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:55:09 host2 sshd[1541672]: Disconnected from invalid user free 159.65.11.28 port 56704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.213
country_id: 3017382
description:
Nov 28 09:01:03 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.213, lip=66.85.158.91, TLS: Connection closed, session=<C4JSQp9Eg+hbxJjV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.177
country_id: 3017382
description:
Nov 28 09:00:36 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.177, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0vq5QJ9EM8lbxJix>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.209
country_id: 3017382
description:
Nov 28 09:00:47 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.209, lip=66.85.158.91, TLS: Connection closed, session=<lHlaQZ9Er7pbxJjR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.73
country_id: 6252001
description:
Nov 28 09:04:33 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.73, lip=66.85.158.92, TLS, session=<OUPTTp9EdufG6xhJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 09:05:10 host2 sshd[1548590]: Disconnected from invalid user admin 2.57.121.112 port 5623 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-28 09:14:41 dovecot_plain authenticator failed for (sarinose) [65.20.205.197]:41283: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:16:23 host2 sshd[1555911]: Disconnected from invalid user oracle 45.78.226.118 port 53836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 3017382
description:
Nov 28 09:17:19 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=94.231.206.11, lip=66.85.158.92, session=<a6x8fJ9EzdBe584L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.5
country_id: 3017382
description:
Nov 28 09:17:31 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=94.231.206.5, lip=66.85.158.92, session=<dog2fZ9E275e584F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.10
country_id: 3017382
description:
Nov 28 09:17:40 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.10, lip=66.85.158.92, session=<gnG5fZ9E+4de584K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 28 09:17:55 host2 sshd[1556503]: Disconnected from invalid user old 182.253.156.184 port 54576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-28 09:18:54 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:52528: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:20:08 host2 sshd[1557814]: Disconnected from invalid user aaa 45.78.226.118 port 44752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 09:21:04 host2 sshd[1558541]: Disconnected from invalid user admin 2.57.121.112 port 6606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 28 09:21:22 host2 sshd[1558695]: Disconnected from invalid user sopuser 182.253.156.184 port 37886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:22:19 host2 sshd[1559281]: Disconnected from invalid user ubadmin 66.96.239.187 port 33802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 28 09:22:45 host2 sshd[1559499]: Disconnected from invalid user rstudio 182.253.156.184 port 40046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-28 09:23:02 dovecot_plain authenticator failed for (defunbolis) [23.30.11.253]:40577: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:24:55 host2 sshd[1560916]: Disconnected from invalid user administrator 66.96.239.187 port 45506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:25:58 host2 sshd[1561573]: Disconnected from invalid user sysadmin 45.78.226.118 port 55272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:26:13 host2 sshd[1561697]: Disconnected from invalid user ubadmin 66.96.239.187 port 42402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-28 09:28:07 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.242.74]:51750: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.184
country_id: 6252001
description:
Nov 28 09:27:42 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=147.185.133.184, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<DzOnoZ9E/96TuYW4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-28 09:27:51 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net ([127.0.0.1]) [98.161.232.9]:37876: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.184
country_id: 6252001
description:
Nov 28 09:28:42 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=147.185.133.184, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<EvMzpZ9EXPaTuYW4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:28:52 host2 sshd[1563012]: Disconnected from invalid user debianuser 66.96.239.187 port 43390 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 178.16.55.198 - hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:31:29 host2 sshd[1564790]: Disconnected from invalid user administrator 45.78.226.118 port 45798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:32:41 host2 sshd[1565628]: Disconnected from invalid user django 66.96.239.187 port 46694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-28 09:36:10 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:58290: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.184
country_id: 6252001
description:
Nov 28 09:36:15 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.184, lip=66.85.158.91, TLS, session=<fok6wJ9EUOaTuYW4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-28 09:36:22 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:49874: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-28 09:42:19 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (hobrus) [174.169.224.27]:53436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.79
country_id: 6252001
description:
Nov 28 09:47:47 host2 pure-ftpd[1575978]: (?@147.185.132.79) [INFO] New connection from 147.185.132.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-28 09:52:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (clent) [87.103.126.54]:43053: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.27.116.226
country_id: 2635167
description:
2025-11-28 09:56:41 dovecot_login authenticator failed for (host-92-27-116-226.static.as13285.net) [92.27.116.226]:40885: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-11-28 09:56:58 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:57680: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.22.187
country_id: 2921044
description:
Nov 28 09:57:20 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=104.248.22.187, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Yl6aC6BEOgVo+Ba7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 09:57:49 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CdM8DaBEfsgXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.246.66.36
country_id: 6252001
description:
Nov 28 10:04:02 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.246.66.36, lip=66.85.158.91, TLS: Connection closed, session=<1OCSI6BE1s8S9kIk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 28 10:05:22 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<RCBWKKBE2J6LonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.251.107.36
country_id: 6252001
description:
Nov 28 10:12:04 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=44.251.107.36, lip=66.85.158.92, TLS: Connection closed, session=<AUNHQKBEzsIs+2sk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.176.34.117
country_id: 1269750
description:
2025-11-28 10:11:54 dovecot_plain authenticator failed for (T8FWR3M6R) [123.176.34.117]:65369: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 28 10:20:23 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4vUIXqBELf4t4/6Y>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.81
country_id: 2635167
description:
Nov 28 10:20:54 host2 dovecot[1005950]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.81, lip=66.85.158.91, TLS, session=<uMvgX6BEUdG594lR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 10:22:11 host2 sshd[1596887]: Disconnected from invalid user admin 2.57.121.112 port 27738 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.184.144.219
country_id: 6252001
description:
Nov 28 10:25:35 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=54.184.144.219, lip=66.85.158.91, TLS: Connection closed, session=<aMyccKBEbLA2uJDb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 10:28:03 host2 sshd[1599325]: Disconnected from invalid user lana 62.60.131.157 port 7011 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov 28 10:30:58 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rlPkg6BEKr5APsU+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov 28 10:31:16 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Tt/zhKBE/utAPsU+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.17.207.148
country_id: 6252001
description:
Nov 28 10:36:13 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.17.207.148, lip=66.85.158.92, session=<WwCtlqBEhtYDEc+U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-11-28 10:44:59 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (stify) [74.90.213.28]:50468: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 10:49:01 host2 sshd[1609072]: Disconnected from invalid user  2.57.121.112 port 61365 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-11-28 10:50:20 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:42066: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-11-28 10:50:47 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:56512: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-28 10:51:16 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:57352: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-11-28 10:51:45 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:38423: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.58
country_id: 6252001
description:
Nov 28 10:52:40 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.58, lip=66.85.158.91, TLS, session=<BsWF0aBE/vDG6xg6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 144.31.90.241
country_id: 660013
description:
Nov 28 10:56:42 host2 pure-ftpd[1614450]: (?@144.31.90.241) [INFO] New connection from 144.31.90.241


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-28 11:00:45 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:51528: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-28 11:01:05 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:37146: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 28 11:02:53 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<3EkM9qBETKpChJl+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-11-28 11:04:58 dovecot_login authenticator failed for (45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:49267: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 28 11:04:59 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<0vVq/aBExqSSOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 28 11:05:16 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=<4naW/qBE6ossyhQX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.176.143.111
country_id: 6252001
description:
Nov 28 11:08:49 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=54.176.143.111, lip=66.85.158.92, TLS: Connection closed, session=<pPc6C6FEvOo2sI9v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Nov 28 11:10:51 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.94, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lKiCEqFEs8CTuYRe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.21
country_id: 6252001
description:
Nov 28 11:18:54 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.21, lip=66.85.158.91, session=<+xJVL6FEfPyTuYQV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:19:56 host2 sshd[1628987]: Disconnected from invalid user developer 172.245.208.136 port 57236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Nov 28 11:20:44 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 43 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wLDeNaFE9sIjy9I0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:20:50 host2 sshd[1629643]: Disconnected from invalid user guest123 154.83.15.123 port 36534 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Nov 28 11:21:19 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<aX7vN6FEbuYjy9I0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:22:52 host2 sshd[1630968]: Disconnected from invalid user proxyuser 172.245.208.136 port 60716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:23:28 host2 sshd[1631432]: Disconnected from invalid user debianuser 154.83.15.123 port 51300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.189
country_id: 130758
description:
Nov 28 11:23:48 host2 sshd[1631607]: Disconnected from invalid user bitrix 85.208.253.189 port 59850 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:24:47 host2 sshd[1632225]: Disconnected from invalid user usuario2 154.83.15.123 port 52602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:26:02 host2 sshd[1632986]: Disconnected from invalid user newuser 154.83.15.123 port 53900 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Nov 28 11:25:23 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS, session=<mFmCRqFE+vMjy9I0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:26:32 host2 sshd[1633214]: Disconnected from invalid user rahul 172.245.208.136 port 39820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:27:16 host2 sshd[1633614]: Disconnected from invalid user kingbase 154.83.15.123 port 55198 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:27:47 host2 sshd[1633991]: Disconnected from invalid user alma 172.245.208.136 port 41752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.189
country_id: 130758
description:
Nov 28 11:30:31 host2 sshd[1635746]: Disconnected from invalid user steam 85.208.253.189 port 56344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Nov 28 11:31:17 host2 sshd[1636173]: Disconnected from invalid user steam 188.166.104.136 port 56100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-11-28 11:32:08 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:38071: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-28 11:33:00 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:48114: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 11:32:18 host2 sshd[1636724]: Disconnected from invalid user admin 2.57.121.112 port 61232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.164.241.170
country_id: 3996063
description:
Nov 28 11:32:24 host2 sshd[1636752]: Disconnected from invalid user ali 189.164.241.170 port 49870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 28 11:32:38 host2 sshd[1636842]: Disconnected from invalid user sonar 198.46.249.175 port 34916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.189
country_id: 130758
description:
Nov 28 11:33:14 host2 sshd[1637129]: Disconnected from invalid user testuser 85.208.253.189 port 56566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-28 11:33:32 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:56667: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Nov 28 11:34:56 host2 sshd[1638087]: Disconnected from invalid user ntps 45.78.201.248 port 33096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.168.21.211
country_id: 6252001
description:
Nov 28 11:35:40 host2 sshd[1638768]: Disconnected from invalid user bitnami 184.168.21.211 port 40032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.164.241.170
country_id: 3996063
description:
Nov 28 11:35:39 host2 sshd[1638753]: Disconnected from invalid user amir 189.164.241.170 port 34146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.116.39
country_id: 1819730
description:
Nov 28 11:37:05 host2 sshd[1639607]: Disconnected from invalid user newuser 154.219.116.39 port 37784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Nov 28 11:37:09 host2 sshd[1639649]: Disconnected from invalid user leo 74.87.117.147 port 64735 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:36:15 host2 sshd[1639117]: Disconnected from invalid user albert 132.248.170.105 port 50046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 28 11:36:23 host2 sshd[1639176]: Disconnected from invalid user es 194.107.115.199 port 64399 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 184.168.21.211
country_id: 6252001
description:
Nov 28 11:36:54 host2 sshd[1639508]: Disconnected from invalid user airflow 184.168.21.211 port 58394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:37:26 host2 sshd[1639804]: Disconnected from invalid user client 132.248.170.105 port 35427 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 11:37:37 host2 sshd[1639922]: Disconnected from invalid user lana 62.60.131.157 port 46368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.211
country_id: 6252001
description:
Nov 28 11:38:04 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZTvhc6FE8sHN0h/T>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.59.185
country_id: 3996063
description:
Nov 28 11:37:14 host2 sshd[1639708]: Disconnected from invalid user ftpuser 187.212.59.185 port 49764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 28 11:37:17 host2 sshd[1639736]: Disconnected from invalid user admin 189.217.130.86 port 43880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 28 11:37:38 host2 sshd[1639939]: Disconnected from invalid user es 194.107.115.199 port 13340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:38:45 host2 sshd[1640768]: Disconnected from invalid user ntps 198.98.55.71 port 48204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:38:31 host2 sshd[1640469]: Disconnected from invalid user ftpuser 132.248.170.105 port 49037 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 28 11:39:32 host2 sshd[1641315]: Disconnected from invalid user administrator 189.217.130.86 port 59543 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.116.39
country_id: 1819730
description:
Nov 28 11:39:37 host2 sshd[1641384]: Disconnected from invalid user test 154.219.116.39 port 45414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Nov 28 11:39:34 host2 sshd[1641358]: Disconnected from invalid user administrator 74.87.117.147 port 15104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:40:46 host2 sshd[1642146]: Disconnected from invalid user admin 132.248.170.105 port 48029 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 28 11:40:24 host2 sshd[1641922]: Disconnected from invalid user ftptest 198.46.249.175 port 36572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 28 11:40:42 host2 sshd[1642095]: Disconnected from invalid user testuser 189.217.130.86 port 38859 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 28 11:41:19 host2 sshd[1642491]: Disconnected from invalid user dev 194.107.115.199 port 53701 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:41:25 host2 sshd[1642569]: Disconnected from invalid user app 198.98.55.71 port 38808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-28 11:42:15 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:37608: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Nov 28 11:42:30 host2 sshd[1643426]: Disconnected from invalid user developer 188.166.104.136 port 38598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.59.185
country_id: 3996063
description:
Nov 28 11:44:10 host2 sshd[1644457]: Disconnected from invalid user admin 187.212.59.185 port 35976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Nov 28 11:44:39 host2 sshd[1644722]: Disconnected from invalid user admin 74.87.117.147 port 13336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.212.59.185
country_id: 3996063
description:
Nov 28 11:46:23 host2 sshd[1646282]: Disconnected from invalid user testuser 187.212.59.185 port 53146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:46:34 host2 sshd[1646467]: Disconnected from invalid user tigergraph 198.98.55.71 port 51666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:49:11 host2 sshd[1647853]: Disconnected from invalid user sonar 198.98.55.71 port 49904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 28 11:51:52 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sysnytech.com>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<16EUpaFEZNt283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 11:54:50 host2 sshd[1651879]: Disconnected from invalid user chelsie 62.60.131.157 port 23266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 11:55:12 host2 sshd[1652209]: Disconnected from invalid user admin 2.57.121.112 port 64452 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.235.25
country_id: 2921044
description:
Nov 28 11:58:00 host2 pure-ftpd[1653783]: (?@134.209.235.25) [INFO] New connection from 134.209.235.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 11:58:11 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<2c6vu6FEcM8XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 11:58:27 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<GEuovKFEpp4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 28 11:58:35 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<RxsfvaFE/KV283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Nov 28 11:59:29 host2 sshd[1654544]: Disconnected from invalid user ftpuser 45.78.201.248 port 49534 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 12:01:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61726: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.79.20
country_id: 6252001
description:
Nov 28 12:02:12 host2 sshd[1656272]: Disconnected from invalid user sftpuser 164.92.79.20 port 35836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.129
country_id: 6252001
description:
Nov 28 12:05:01 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.129, lip=66.85.158.92, session=<8O881KFEPosUQcKB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.176
country_id: 6252001
description:
Nov 28 12:04:27 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.176, lip=66.85.158.91, session=<rjgx0qFE/s0UQcGw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.79.20
country_id: 6252001
description:
Nov 28 12:06:29 host2 sshd[1658978]: Disconnected from invalid user aj 164.92.79.20 port 55260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.79.20
country_id: 6252001
description:
Nov 28 12:07:34 host2 sshd[1659532]: Disconnected from invalid user info 164.92.79.20 port 39334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.93.41
country_id: 2635167
description:
Nov 28 12:09:24 host2 sshd[1660579]: Disconnected from invalid user will 46.101.93.41 port 45556 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.93.41
country_id: 2635167
description:
Nov 28 12:10:26 host2 sshd[1661447]: Disconnected from invalid user hello 46.101.93.41 port 39838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.24.211.19
country_id: 2661886
description:
Nov 28 12:15:37 host2 sshd[1664824]: Disconnecting invalid user admin 85.24.211.19 port 38156: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 85.24.211.19
country_id: 2661886
description:
Nov 28 12:15:26 host2 sshd[1664736]: Disconnecting authenticating user root 85.24.211.19 port 35862: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 85.24.211.19
country_id: 2661886
description:
Nov 28 12:15:26 host2 sshd[1664736]: error: maximum authentication attempts exceeded for root from 85.24.211.19 port 35862 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Nov 28 12:16:07 host2 sshd[1665082]: Disconnected from invalid user root1 45.78.201.248 port 34276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.10
country_id: 2921044
description:
Nov 28 12:17:36 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=57.129.64.10, lip=66.85.158.91, TLS: Connection closed, session=<TmNBAaJEZtg5gUAK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.110.87.17
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.110.87.17 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.90.242.67
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 142.90.242.67 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.166.62.220
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 78.166.62.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.105.215
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.134.105.215 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.15.68.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.15.68.35 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.23.230.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.23.230.146 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.49.251.250
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.49.251.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 12:18:37 host2 sshd[1666720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-28 12:19:47 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.194.22]:37064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-11-28 12:20:05 dovecot_login authenticator failed for ([127.0.0.1]) [64.49.97.15]:58934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 28 12:26:01 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9dNZH6JEUP7CpRCn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.254.196
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.236.254.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 12:28:44 host2 sshd[1673116]: Disconnected from invalid user maria 2.57.121.112 port 61987 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.42.229.225
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.42.229.225 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.183.182.87
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.183.182.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.153.45
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.190.153.45 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.69.12.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.69.12.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.161.107.143
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.161.107.143 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.159.198.12
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.159.198.12 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.177.140
country_id: 3865483
description:
Nov 28 12:30:57 host2 sshd[1674420]: Disconnected from invalid user halo 186.122.177.140 port 20486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:36:10 host2 sshd[1677265]: Disconnected from invalid user javad 45.8.93.107 port 42076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:38:25 host2 sshd[1678565]: Disconnected from invalid user ts2 45.8.93.107 port 48532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:40:38 host2 sshd[1680075]: Disconnected from invalid user g 45.8.93.107 port 51028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-28 12:41:07 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (acoas) [73.129.57.71]:43414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:41:39 host2 sshd[1680590]: Disconnected from invalid user vpn 45.8.93.107 port 38900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:42:39 host2 sshd[1681082]: Disconnected from invalid user vlad 45.8.93.107 port 57152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.177.140
country_id: 3865483
description:
Nov 28 12:44:34 host2 sshd[1681980]: Disconnected from invalid user manager 186.122.177.140 port 14262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 12:45:18 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<P00yZKJELOgXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.122.177.140
country_id: 3865483
description:
Nov 28 12:47:56 host2 sshd[1684545]: Disconnected from invalid user exx 186.122.177.140 port 61785 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.6.181.219
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.6.181.219 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.178.2.83
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.178.2.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.133.4.238
country_id: 2802361
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.133.4.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.1.243
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.229.1.243 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.115.145.47
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.115.145.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.0.46.28
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 179.0.46.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.185.47.247
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.185.47.247 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 28 12:48:23 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<Rt5Vb6JElAkt4/6Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.41
country_id: 6252001
description:
Nov 28 12:51:23 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.41, lip=66.85.158.91, TLS, session=<n6sNeqJEuPPG6xgp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.85.174.239
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.85.174.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.87.65.16
country_id: 1527747
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.87.65.16 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.204.248.223
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.204.248.223 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.163.252.4
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 78.163.252.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 12:53:29 host2 sshd[1688380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.131.176.204
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.131.176.204 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.2.50
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.9.2.50 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.241.83.229
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.241.83.229 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 12:55:55 host2 sshd[1690606]: Disconnected from invalid user admin 2.57.121.112 port 21149 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-28 13:00:35 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54950: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-28 13:00:26 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:13174: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.207
country_id: 6252001
description:
Nov 28 13:02:46 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.207, lip=66.85.158.91, session=<ymXLoqJEZcTDuEzP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.161
country_id: 6252001
description:
Nov 28 13:02:50 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.161, lip=66.85.158.91, session=<jmn7oqJE3d3DuEyh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 28 13:02:54 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<ldk3o6JEqn1ChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.202
country_id: 6252001
description:
Nov 28 13:02:31 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.202, lip=66.85.158.91, session=<miPcoaJE6+TDuEzK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.204
country_id: 6252001
description:
Nov 28 13:02:41 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.204, lip=66.85.158.91, session=<nFh3oqJEn63DuEzM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Nov 28 13:03:05 host2 sshd[1695143]: Disconnected from invalid user halo 45.78.201.182 port 59106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Nov 28 13:04:19 host2 sshd[1696366]: Disconnected from invalid user local 74.249.246.151 port 33610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-28 13:04:50 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (beyloble) [68.46.148.180]:47922: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.54
country_id: 1643084
description:
Nov 28 13:05:41 host2 sshd[1697204]: Disconnected from invalid user ftpuser 103.82.93.54 port 35072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Nov 28 13:06:18 host2 sshd[1697487]: Disconnected from invalid user exx 108.173.137.12 port 37490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Nov 28 13:06:28 host2 sshd[1697537]: Disconnected from invalid user jrodrig 23.227.147.163 port 37438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.54
country_id: 1643084
description:
Nov 28 13:07:13 host2 sshd[1698109]: Disconnected from invalid user work 103.82.93.54 port 55452 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.246.151
country_id: 6252001
description:
Nov 28 13:08:15 host2 sshd[1698663]: Disconnected from invalid user erpnext 74.249.246.151 port 41992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Nov 28 13:08:36 host2 sshd[1698812]: Disconnected from invalid user sammy 23.227.147.163 port 53176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Nov 28 13:09:46 host2 sshd[1699638]: Disconnected from invalid user dspace 23.227.147.163 port 54358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.54
country_id: 1643084
description:
Nov 28 13:10:29 host2 sshd[1700165]: Disconnected from invalid user runner 103.82.93.54 port 40930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.54
country_id: 1643084
description:
Nov 28 13:11:56 host2 sshd[1700983]: Disconnected from invalid user tempuser 103.82.93.54 port 55768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Nov 28 13:11:07 host2 sshd[1700564]: Disconnected from invalid user devuser 23.227.147.163 port 48136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Nov 28 13:11:25 host2 sshd[1700689]: Disconnected from invalid user exx 45.78.201.182 port 48496 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.179.204
country_id: 2017370
description:
Nov 28 13:13:55 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.179.204, lip=66.85.158.91, session=<hmajyqJEBNmlmrPM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Nov 28 13:13:43 host2 sshd[1702084]: Disconnected from invalid user ali 45.78.201.182 port 50652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.179.204
country_id: 2017370
description:
Nov 28 13:14:13 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=165.154.179.204, lip=66.85.158.91, session=<be29y6JECtmlmrPM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Nov 28 13:16:04 host2 sshd[1703537]: Disconnected from invalid user ftpuser 108.173.137.12 port 59862 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.179.204
country_id: 2017370
description:
Nov 28 13:18:02 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.179.204, lip=66.85.158.92, session=<wVFk2aJEVtKlmrPM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.173.137.12
country_id: 6251999
description:
Nov 28 13:17:18 host2 sshd[1704314]: Disconnected from invalid user work 108.173.137.12 port 34110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.179.204
country_id: 2017370
description:
Nov 28 13:18:22 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.179.204, lip=66.85.158.92, session=<2WiM2qJE7tSlmrPM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Nov 28 13:18:28 host2 sshd[1704926]: Disconnected from invalid user monitoring 45.78.201.182 port 34476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-28 13:18:42 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:8277: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-28 13:19:09 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:34024: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Nov 28 13:20:45 host2 sshd[1706428]: Disconnected from invalid user system 45.78.201.182 port 37730 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.228.104.112
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.228.104.112 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.149.36.37
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 177.149.36.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 28 13:34:08 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, session=<6Pv3EqNEZktChJl4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.217.160
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.205.217.160 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.78.183.60
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.78.183.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.147.242.98
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 27.147.242.98 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.148.37.9
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.148.37.9 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.179.199.51
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.179.199.51 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.86
country_id: 6252001
description:
Nov 28 13:40:42 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.236.228.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<NnhvKqNEQjqs7ORW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Nov 28 13:41:23 host2 sshd[1718897]: Disconnected from invalid user steam 45.172.153.100 port 42792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.153.100
country_id: 3508796
description:
Nov 28 13:43:54 host2 sshd[1720212]: Disconnected from invalid user thomas 45.172.153.100 port 54182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-28 13:45:07 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (trasity) [73.213.237.28]:47508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-28 13:53:53 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:43090: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-28 13:54:17 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:36438: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 28 13:55:26 host2 sshd[1727936]: Disconnected from invalid user astra 103.98.176.164 port 44298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-28 13:55:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (toredecin) [87.103.126.54]:47945: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-28 13:56:01 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (guist) [73.176.157.57]:43806: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Nov 28 13:56:12 host2 sshd[1728484]: Disconnected from invalid user cgpexpert 74.94.234.151 port 54724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 28 13:58:38 host2 sshd[1729698]: Disconnected from invalid user root2 103.98.176.164 port 37314 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.126.58
country_id: 6252001
description:
Nov 28 13:59:54 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.126.58, lip=66.85.158.91, session=<ao4bb6NEZLItOH46>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-28 13:59:23 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (inessial) [73.176.157.57]:48540: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.96.125
country_id: 6252001
description:
Nov 28 13:59:55 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.33.96.125, lip=66.85.158.91, session=<3ownb6NEbOctIWB9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 28 13:59:58 host2 sshd[1730356]: Disconnected from invalid user postgres 103.98.176.164 port 45790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Nov 28 14:00:41 host2 sshd[1731028]: Disconnected from invalid user bot 74.94.234.151 port 44746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Nov 28 14:01:57 host2 sshd[1731743]: Disconnected from invalid user oracle 74.94.234.151 port 43348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 28 14:02:39 host2 sshd[1732296]: Disconnected from invalid user admin 103.98.176.164 port 53528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 28 14:03:58 host2 sshd[1733625]: Disconnected from invalid user ubuntu 103.98.176.164 port 46532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.94.234.151
country_id: 6252001
description:
Nov 28 14:04:20 host2 sshd[1733896]: Disconnected from invalid user g 74.94.234.151 port 40568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-28 14:08:50 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:40922: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-28 14:08:40 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:60482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 14:10:49 host2 sshd[1737878]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.190.227
country_id: 6252001
description:
Nov 28 14:16:35 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=157.230.190.227, lip=66.85.158.91, session=<UOHEqqNE8rid5r7j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.164.150.124
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.164.150.124 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.117.148.95
country_id: 1527747
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.117.148.95 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.206.54.158
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.206.54.158 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.147.61.191
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.147.61.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.98.130.240
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 94.98.130.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.55.207
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.55.207 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.249.229
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 180.75.249.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-28 14:24:41 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:42254: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-28 14:24:54 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:51110: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 14:28:16 host2 sshd[1748629]: Disconnected from invalid user admin 2.57.121.112 port 45986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-28 14:33:45 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:28601: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 28 14:39:24 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<7XBh/KNEMf/CpRCl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 14:45:40 host2 sshd[1761755]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-28 14:47:47 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (rextingly) [174.161.27.82]:42269: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 28 14:48:16 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<9pwNHKREpsADU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Nov 28 14:50:03 host2 sshd[1764449]: Disconnected from invalid user supermaint 185.216.116.13 port 36678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Nov 28 14:51:24 host2 sshd[1765289]: Disconnected from invalid user devops 185.216.116.13 port 35204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 14:51:33 host2 sshd[1765339]: Disconnected from invalid user  2.57.121.112 port 62814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.104
country_id: 1880251
description:
Nov 28 14:52:30 host2 sshd[1765774]: Disconnected from invalid user userb 101.47.162.104 port 48704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Nov 28 14:52:44 host2 sshd[1765904]: Disconnected from invalid user sipv 185.216.116.13 port 33720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.146
country_id: 3865483
description:
Nov 28 14:52:45 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=45.238.106.146, lip=66.85.158.91, TLS, session=<f9vVKqREwd8t7mqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.201.229.46
country_id: 3469034
description:
Nov 28 14:53:10 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=128.201.229.46, lip=66.85.158.91, TLS, session=<rzpSLKREc9+AyeUu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.104
country_id: 1880251
description:
Nov 28 14:55:26 host2 sshd[1768092]: Disconnected from invalid user dolphinscheduler 101.47.162.104 port 39028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.42
country_id: 1643084
description:
Nov 28 14:57:00 host2 sshd[1768968]: Disconnected from invalid user dolphinscheduler 103.250.10.42 port 45932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Nov 28 15:05:28 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS, session=<mN+YWaRE8PuTuYRG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 28 15:08:39 host2 dovecot[1005950]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<85/4ZKREYM8D7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.104
country_id: 1880251
description:
Nov 28 15:09:44 host2 sshd[1776742]: Disconnected from invalid user autcom 101.47.162.104 port 49192 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.215.234.33
country_id: 3508796
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 200.215.234.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.98.129.89
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.98.129.89 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.35.167.45
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 82.35.167.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.109.65.251
country_id: 174982
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.109.65.251 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.35.202
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.9.35.202 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.157.236.183
country_id: 1227603
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 175.157.236.183 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.122.74
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.122.74 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.104
country_id: 1880251
description:
Nov 28 15:12:22 host2 sshd[1778260]: Disconnected from invalid user mailuser 101.47.162.104 port 52968 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.120.89.22
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.120.89.22 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.179.80.250
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.179.80.250 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.40.226.95
country_id: 286963
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 37.40.226.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.47.132.125
country_id: 587116
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.47.132.125 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.99.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.99.151 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.148.86.146
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.148.86.146 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.151
country_id: 6252001
description:
Nov 28 15:14:57 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.192.151, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<72GBe6REhsoUQcCX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.96.232
country_id: 294640
description:
2025-11-28 15:16:04 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:35678: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.115.112.108
country_id: 6252001
description:
2025-11-28 15:15:40 dovecot_login authenticator failed for 146-115-112-108.s362.c3-0.wak-ubr1.sbo-wak.ma.cable.rcncustomer.com [146.115.112.108]:47326: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.183.177
country_id: 6252001
description:
Nov 28 15:16:16 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.183.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jk02gKRE8M8ofLex>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-11-28 15:18:08 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:38842: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-28 15:18:51 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:59051: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.52.34.13
country_id: 3865483
description:
2025-11-28 15:23:43 dovecot_login authenticator failed for ([190.52.34.13]) [190.52.34.13]:43432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-11-28 15:24:16 dovecot_login authenticator failed for ([93.121.175.220]) [93.121.175.220]:46572: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.177.206.241
country_id: 6252001
description:
Nov 28 15:27:58 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.177.206.241, lip=66.85.158.92, session=<BfcEqqREXKKLsc7x>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.24.247
country_id: 6252001
description:
Nov 28 15:27:58 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.24.247, lip=66.85.158.92, session=<5bEOqqREpMal4xj3>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.78
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.78: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.3
country_id: 3017382
description:
Nov 28 15:28:34 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.3, lip=66.85.158.91, session=<OBEwrKREuctb51kD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.104
country_id: 3017382
description:
Nov 28 15:28:44 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.104, lip=66.85.158.91, session=<sPHKrKREX9Rb51lo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 15:28:52 host2 sshd[1788574]: Disconnected from invalid user admin 2.57.121.112 port 7352 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.5
country_id: 3017382
description:
Nov 28 15:28:57 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.5, lip=66.85.158.91, session=<eeqQraREeY1b51kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.191
country_id: 6252001
description:
Nov 28 15:29:18 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.255.221.191, lip=66.85.158.92, session=<IJrUrqRENIWt/92/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-28 15:37:29 dovecot_login authenticator failed for (nsg-corporate-150.144.185.122.airtel.in) [122.185.144.150]:55788: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-28 15:37:41 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:56320: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.33
country_id: 2186224
description:
2025-11-28 15:37:57 dovecot_login authenticator failed for ([121.73.167.33]) [121.73.167.33]:36438: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 28 15:38:09 host2 sshd[1795699]: Disconnected from invalid user work 102.211.209.191 port 39772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 28 15:41:26 host2 sshd[1810461]: Disconnected from invalid user qiyuesuo 102.211.209.191 port 45652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 15:42:17 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<LWMK3aRE2MUXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 28 15:42:52 host2 sshd[1811726]: Disconnected from invalid user nagios 102.211.209.191 port 37256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 28 15:45:31 host2 sshd[1813523]: Disconnected from invalid user zookeeper 102.211.209.191 port 50272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:46:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<34u97KRErtEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-11-28 15:46:43 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:35402: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 28 15:46:45 host2 sshd[1814757]: Disconnected from invalid user gitlab-runner 102.211.209.191 port 34314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-11-28 15:47:06 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:36832: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:47:08 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<FOyY7qREjOMDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 15:47:45 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49674: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 15:48:17 host2 sshd[1815654]: Disconnected from invalid user admin 2.57.121.112 port 55437 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:48:39 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0NkI9KRECMADhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 15:49:41 host2 sshd[1816445]: Disconnected from invalid user  2.57.121.112 port 63019 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:50:23 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<xp8++qREEL4DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.16.11
country_id: 6252001
description:
2025-11-28 15:51:09 dovecot_plain authenticator failed for ([10.10.18.176]) [84.239.16.11]:31861: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:51:16 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<HHtb/aRE7ukDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:52:35 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ORYTAqVEUI8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Nov 28 15:52:52 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<FYgdA6VE+FbAm1rc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 28 15:53:21 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+5LPBKVEFNkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.194.5
country_id: 2921044
description:
Nov 28 15:57:27 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=207.154.194.5, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BJyAE6VEDHjPmsIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.39.96
country_id: 2921044
description:
Nov 28 15:56:52 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.39.96, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<jiplEaVEA4Jo+Cdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-28 15:59:11 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:56634: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-11-28 15:59:24 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:54086: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 16:03:24 host2 sshd[1826056]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-28 16:02:57 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (archrize) [81.225.30.107]:46445: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 16:11:25 host2 sshd[1831932]: Disconnected from invalid user janie 62.60.131.157 port 54413 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.219
country_id: 3077311
description:
2025-11-28 16:12:11 dovecot_login authenticator failed for (ADMIN) [212.102.39.219]:58078: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 151.237.57.13
country_id: 2510769
description:
Nov 28 16:15:39 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=151.237.57.13, lip=66.85.158.91, TLS, session=<ViKUU6VEJMuX7TkN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.65
country_id: 3469034
description:
Nov 28 16:15:59 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2>, method=PLAIN, rip=179.189.196.65, lip=66.85.158.91, TLS, session=<gTW4VKVE3YazvcRB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.136.89
country_id: 2963597
description:
Nov 28 16:16:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=89.106.136.89, lip=66.85.158.91, TLS, session=</fQQV6VEichZaohZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.114
country_id: 953987
description:
Nov 28 16:16:59 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=102.64.40.114, lip=66.85.158.91, TLS, session=<wdVAWKVE0r5mQChy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-28 16:19:36 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:52454: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.34.66
country_id: 1282988
description:
[2025-11-28 16:19:44 +0530] info [cpaneld] 111.119.34.66 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.242.238
country_id: 1733045
description:
[2025-11-28 16:19:13 +0530] info [cpaneld] 27.125.242.238 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.211.112.5
country_id: 130758
description:
[2025-11-28 16:19:20 +0530] info [cpaneld] 5.211.112.5 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.6.21.104
country_id: 3469034
description:
[2025-11-28 16:19:25 +0530] info [cpaneld] 45.6.21.104 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.205.23
country_id: 3996063
description:
[2025-11-28 16:19:32 +0530] info [whostmgrd] 187.190.205.23 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.249.131.42
country_id: 6252001
description:
[2025-11-28 16:19:48 +0530] info [cpaneld] 76.249.131.42 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.166
country_id: 2413451
description:
2025-11-28 16:19:55 dovecot_login authenticator failed for (197-255-207-166.netpagedns.net) [197.255.207.166]:58701: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.217.75.168
country_id: 1269750
description:
Nov 28 16:21:41 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<marketing>, method=PLAIN, rip=117.217.75.168, lip=66.85.158.91, TLS, session=<mGkMaaVET9112Uuo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.198.129.123
country_id: 1819730
description:
Nov 28 16:21:20 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=203.198.129.123, lip=66.85.158.91, session=<BfTBaKVEOP/LxoF7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-28 16:24:31 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:38154: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-28 16:24:43 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:57448: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-11-28 16:25:01 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:38928: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 28 16:25:56 host2 sshd[1840961]: Disconnected from invalid user deploy 37.255.249.201 port 44546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.99.0
country_id: 3175395
description:
Nov 28 16:28:07 host2 sshd[1842250]: Disconnected from invalid user dangulo 151.43.99.0 port 21225 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 28 16:28:42 host2 sshd[1842543]: Disconnected from invalid user blue 37.255.249.201 port 53232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.255.249.201
country_id: 130758
description:
Nov 28 16:30:02 host2 sshd[1843378]: Disconnected from invalid user syncthing 37.255.249.201 port 60172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 28 16:31:20 host2 sshd[1844415]: Disconnected from invalid user syncuser 37.255.249.201 port 46470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 16:33:25 host2 sshd[1845609]: Disconnected from invalid user admin 2.57.121.112 port 62729 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 16:38:16 host2 sshd[1848600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-28 16:38:02 dovecot_plain authenticator failed for (wirionize) [154.146.240.123]:40180: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-28 16:40:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (glolla) [87.103.126.54]:64929: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-28 16:43:01 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:44972: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-28 16:43:18 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:55398: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 16:48:35 host2 sshd[1856350]: Disconnected from invalid user admin 2.57.121.112 port 15771 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Nov 28 16:52:11 host2 sshd[1859188]: Disconnected from invalid user user1 197.199.224.52 port 48344 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 28 16:52:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<jxCS16VECMsDU5En>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.34.96.73
country_id: 2635167
description:
[2025-11-28 16:56:51 +0530] info [cpaneld] 82.34.96.73 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.233.85.171
country_id: 1269750
description:
[2025-11-28 16:56:59 +0530] info [cpaneld] 223.233.85.171 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.244.77.137
country_id: 1282988
description:
[2025-11-28 16:57:19 +0530] info [whostmgrd] 49.244.77.137 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.62.39.1
country_id: 1694008
description:
[2025-11-28 16:57:37 +0530] info [cpaneld] 158.62.39.1 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.120.251.182
country_id: 1269750
description:
[2025-11-28 16:56:43 +0530] info [cpaneld] 103.120.251.182 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.22.122.142
country_id: 953987
description:
[2025-11-28 16:57:46 +0530] info [cpaneld] 102.22.122.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 28 16:57:49 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<8F4/66VE/sNRvaKO>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.177.191.218
country_id: 2017370
description:
[2025-11-28 16:58:00 +0530] info [cpaneld] 81.177.191.218 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.199.224.52
country_id: 357994
description:
Nov 28 16:59:51 host2 sshd[1865126]: Disconnected from invalid user joe 197.199.224.52 port 46838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.184.193.67
country_id: 6252001
description:
2025-11-28 17:00:36 dovecot_login authenticator failed for ([157.230.66.74]) [137.184.193.67]:58414: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Nov 28 17:01:02 host2 sshd[1866120]: Disconnected from invalid user git 197.199.224.52 port 48834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Nov 28 17:02:09 host2 sshd[1866799]: Disconnected from invalid user pdx 197.199.224.52 port 50846 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 28 17:11:15 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<VC5yG6ZEctMs3lFz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.182.147.189
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.182.147.189 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.190.238.113
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 180.190.238.113 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 120.29.66.88
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 120.29.66.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.195.151
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.37.195.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.163.1.109
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.163.1.109 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.87.140.243
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.87.140.243 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.167.46
country_id: 1269750
description:
2025-11-28 17:16:53 dovecot_plain authenticator failed for (U289EEWT) [157.49.167.46]:54286: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 17:18:39 host2 sshd[1876745]: Disconnected from invalid user janie 62.60.131.157 port 35113 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Nov 28 17:18:56 host2 sshd[1876900]: Disconnected from invalid user test1 12.189.234.27 port 45744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Nov 28 17:20:58 host2 sshd[1878072]: Disconnected from invalid user ftpadmin 12.189.234.27 port 37320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.27
country_id: 6252001
description:
Nov 28 17:23:17 host2 sshd[1879218]: Disconnected from invalid user odoo15 12.189.234.27 port 39272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Nov 28 17:23:37 host2 sshd[1879353]: Disconnected from invalid user ali 135.237.122.43 port 54260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 17:24:26 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<0ZlzSqZEoLsXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 17:24:45 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<wXeSS6ZEspIXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.237.122.43
country_id: 6252001
description:
Nov 28 17:26:31 host2 sshd[1881204]: Disconnected from invalid user system 135.237.122.43 port 45880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Nov 28 17:27:09 host2 sshd[1881526]: Disconnected from invalid user ts1 12.189.234.27 port 56292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 28 17:27:19 host2 sshd[1881612]: Disconnected from invalid user mailuser 201.217.12.57 port 53312 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.31.145
country_id: 2802361
description:
Nov 28 17:28:29 host2 pure-ftpd[1882162]: (?@35.187.31.145) [INFO] New connection from 35.187.31.145


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Nov 28 17:29:02 host2 sshd[1882581]: Disconnected from invalid user runner 135.237.122.43 port 52224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.105
country_id: 6252001
description:
2025-11-28 17:30:24 dovecot_login authenticator failed for (ADMIN) [102.129.252.105]:44128: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Nov 28 17:30:28 host2 sshd[1883566]: Disconnected from invalid user halo 135.237.122.43 port 37228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 28 17:30:55 host2 sshd[1883858]: Disconnected from invalid user mailuser 104.168.4.151 port 49220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 28 17:32:13 host2 sshd[1884738]: Disconnected from invalid user tempuser 35.199.95.142 port 38200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-28 17:32:32 dovecot_plain authenticator failed for (unviumet) [102.53.15.56]:33593: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 28 17:31:45 host2 sshd[1884425]: Disconnected from invalid user username 201.217.12.57 port 51756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 28 17:32:07 host2 sshd[1884687]: Disconnected from invalid user bitnami 104.168.4.151 port 49328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.230.151
country_id: 1880251
description:
Nov 28 17:32:41 host2 sshd[1884975]: Disconnected from invalid user work 43.134.230.151 port 40904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 28 17:34:22 host2 sshd[1886162]: Disconnected from invalid user tempuser 104.168.4.151 port 49540 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Nov 28 17:34:39 host2 pure-ftpd[1886312]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.230.151
country_id: 1880251
description:
Nov 28 17:33:58 host2 sshd[1885865]: Disconnected from invalid user tempuser 43.134.230.151 port 40136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 28 17:35:22 host2 sshd[1886987]: Disconnected from invalid user support 104.168.4.151 port 49646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 17:35:35 host2 sshd[1887032]: Disconnected from invalid user leanne 62.60.131.157 port 8699 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 28 17:36:25 host2 sshd[1887511]: Disconnected from invalid user admin 104.168.4.151 port 49748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 28 17:37:13 host2 sshd[1887908]: Disconnected from invalid user postgres 147.182.173.108 port 40516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 28 17:36:40 host2 sshd[1887602]: Disconnected from invalid user tempuser 201.217.12.57 port 50346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 28 17:36:46 host2 sshd[1887661]: Disconnected from invalid user admin 35.199.95.142 port 44858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.230.151
country_id: 1880251
description:
Nov 28 17:37:48 host2 sshd[1888279]: Disconnected from invalid user ali 43.134.230.151 port 37850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-28 17:37:59 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:56222: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 28 17:38:19 host2 sshd[1888615]: Disconnected from invalid user ali 147.182.173.108 port 33668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-28 17:38:26 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:41850: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 28 17:39:21 host2 sshd[1889375]: Disconnected from invalid user rstudio 147.182.173.108 port 43480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 28 17:39:53 host2 sshd[1889698]: Disconnected from invalid user support 181.123.136.11 port 54928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 28 17:39:58 host2 sshd[1889725]: Disconnected from invalid user administrator 35.199.95.142 port 49144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 28 17:41:26 host2 sshd[1890967]: Disconnected from invalid user user 201.217.12.57 port 44762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 28 17:43:25 host2 sshd[1891998]: Disconnected from invalid user s 147.182.173.108 port 43186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-28 17:44:20 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:59642: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 17:46:26 host2 sshd[1894042]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:47:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<6iOUm6ZEOoQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.66
country_id: 597427
description:
2025-11-28 17:46:49 dovecot_login authenticator failed for (ADMIN) [194.32.122.66]:34075: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:48:11 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<dfCAn6ZEqukDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 28 17:48:34 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Laq9oKZEMHhRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:49:38 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<HCK2pKZEnKkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:50:44 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<HSyZqKZELIgDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:51:21 host2 dovecot[1796015]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<WOrYqqZErIQDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 28 17:52:05 host2 sshd[1898443]: Disconnected from invalid user administrator 181.123.136.11 port 34294 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-11-28 17:52:09 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:41622: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:52:29 host2 dovecot[1796015]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<lrTerqZEUqQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-28 17:52:38 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:12800: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:51:44 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<hS8rrKZE2JIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-28 17:53:18 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:53510: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 28 17:52:48 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<1VgBsKZEGIEDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-28 17:54:03 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:57682: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 28 17:53:52 host2 sshd[1899539]: Disconnected from invalid user production 181.123.136.11 port 40248 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 17:56:42 host2 sshd[1902328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.245
country_id: 6252001
description:
Nov 28 17:59:34 host2 pure-ftpd[1904769]: (?@135.237.126.245) [INFO] New connection from 135.237.126.245


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 18:00:29 host2 sshd[1905573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov 28 18:04:49 host2 sshd[1909200]: Disconnected from invalid user precio01 162.240.39.179 port 44064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-11-28 18:05:47 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:45140: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 28 18:05:50 host2 sshd[1910119]: Disconnected from invalid user monitoring 102.88.137.80 port 49636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 28 18:07:33 host2 sshd[1911248]: Disconnected from invalid user admin123 102.88.137.80 port 1195 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-28 18:06:43 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:40454: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov 28 18:07:55 host2 sshd[1911427]: Disconnected from invalid user asterisk 162.240.39.179 port 32780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 28 18:09:01 host2 sshd[1912115]: Disconnected from invalid user zimbra 102.88.137.80 port 33337 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov 28 18:09:14 host2 sshd[1912274]: Disconnected from invalid user bitrix 162.240.39.179 port 60070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov 28 18:10:27 host2 sshd[1913151]: Disconnected from invalid user airflow 162.240.39.179 port 58872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 28 18:10:34 host2 sshd[1913192]: Disconnected from invalid user syncthing 102.88.137.80 port 33615 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Nov 28 18:12:54 host2 sshd[1914613]: Disconnected from invalid user bitnami 162.240.39.179 port 57218 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 28 18:13:50 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, TLS, session=<TkA1+6ZEcprPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 28 18:13:50 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<6248+6ZEeJrPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 28 18:14:57 host2 sshd[1916050]: Disconnected from invalid user cgpexpert 102.88.137.80 port 17536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-28 18:17:21 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:57363: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-28 18:17:34 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:55556: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.78
country_id: 6252001
description:
Nov 28 18:19:46 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.78, lip=66.85.158.92, TLS, session=<EM1zEKdEcoJC5DVO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 28 18:22:26 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Ny34GadE6OLPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.131
country_id: 1562822
description:
2025-11-28 18:22:39 dovecot_login authenticator failed for (ADMIN) [173.239.247.131]:36836: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 28 18:22:25 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS, session=<gEbwGadEgtzPWvQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 28 18:23:34 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sysnytech.com>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<i9LlHadEEqx283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 18:24:18 host2 sshd[1921283]: Disconnected from invalid user admin 2.57.121.112 port 48647 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 18:32:40 host2 sshd[1925915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 18:42:28 host2 sshd[1931496]: Disconnected from invalid user leanne 62.60.131.157 port 51412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-28 18:42:40 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (stralvarid) [71.224.169.28]:52108: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.20
country_id: 2589581
description:
2025-11-28 18:42:42 dovecot_login authenticator failed for (ADMIN) [176.125.228.20]:35495: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.28.190.93
country_id: 1814991
description:
2025-11-28 18:44:24 dovecot_login authenticator failed for (KJIDG3VWy) [117.28.190.93]:62059: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.28.190.93
country_id: 1814991
description:
2025-11-28 18:45:12 dovecot_login authenticator failed for (eqJ5mFEG) [117.28.190.93]:62837: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.28.190.93
country_id: 1814991
description:
2025-11-28 18:45:42 dovecot_login authenticator failed for (JqGNpkmz7m) [117.28.190.93]:63405: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-28 18:52:35 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:43739: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-11-28 18:52:56 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:58839: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 18:54:08 host2 sshd[1939017]: Disconnecting invalid user  2.57.121.112 port 61822: Change of username or service not allowed: (,ssh-connection) -> (cisco,ssh-connection) [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.250.199.26
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.250.199.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.129.232.116
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.129.232.116 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.88.132.191
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.88.132.191 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Nov 28 18:54:45 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fTaKjadEWPbAm1rc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.77.196.225
country_id: 3617476
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.77.196.225 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.115.135
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 203.106.115.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.133.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.39.133.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.40.133.145
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.40.133.145 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 18:59:20 host2 sshd[1942450]: Disconnected from invalid user ari 62.60.131.157 port 25494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.63
country_id: 1733045
description:
2025-11-28 18:59:31 dovecot_login authenticator failed for ([49.124.151.63]) [49.124.151.63]:42310: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 19:01:35 host2 sshd[1943966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.236
country_id: 718075
description:
2025-11-28 19:00:55 dovecot_login authenticator failed for (ADMIN) [185.225.28.236]:13041: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-28 19:04:03 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (unchendly) [98.227.25.115]:36314: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 28 19:04:11 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<9LFHr6dEZM0D7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.82.138
country_id: 99237
description:
2025-11-28 19:03:55 dovecot_plain authenticator failed for (CEJ5O) [169.224.82.138]:58033: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.14
country_id: 6252001
description:
Nov 28 19:10:43 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.14, lip=66.85.158.91, session=<bC+jxqdEnSBAPpwO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Nov 28 19:10:54 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.10, lip=66.85.158.91, TLS: Connection closed, session=<BExXx6dEAo5APpwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-11-28 19:12:13 dovecot_plain authenticator failed for (amboodeles) [5.11.140.219]:48328: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-28 19:15:55 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:55324: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-28 19:16:36 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:36554: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 19:23:56 host2 sshd[1961025]: Disconnected from invalid user admin 2.57.121.112 port 19686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.21
country_id: 146669
description:
2025-11-28 19:31:31 dovecot_login authenticator failed for (ADMIN) [185.253.162.21]:65292: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.225.251.119
country_id: 2661886
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 90.225.251.119 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.212.170
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.234.212.170 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.36.131.219
country_id: 1522867
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 46.36.131.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.70.195
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.84.70.195 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.55.93.108
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 27.55.93.108 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.30.63.88
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.30.63.88 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.87.45
country_id: 286963
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.199.87.45 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-28 19:39:23 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (preters) [24.1.200.187]:47514: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Nov 28 19:46:31 host2 sshd[1981915]: Disconnected from invalid user customer 103.183.74.214 port 51712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Nov 28 19:47:52 host2 sshd[1982817]: Disconnected from invalid user sipv 191.37.72.46 port 38736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.23
country_id: 6251999
description:
2025-11-28 19:50:00 dovecot_login authenticator failed for (ADMIN) [66.56.81.23]:33790: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.102.103.179
country_id: 1814991
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.102.103.179 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.79.21
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 49.36.79.21 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Nov 28 19:49:41 host2 sshd[1984230]: Disconnected from invalid user fred 103.183.74.214 port 42314 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.12.196
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.12.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.107.251.126
country_id: 248816
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.107.251.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.40.94.112
country_id: 1814991
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 111.40.94.112 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.111.232.187
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.111.232.187 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.163.149.170
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 200.163.149.170 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 28 19:51:04 host2 sshd[1985399]: Disconnected from invalid user alma 138.124.20.112 port 35350 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 19:51:33 host2 sshd[1985752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.183.74.214
country_id: 1643084
description:
Nov 28 19:52:33 host2 sshd[1986386]: Disconnected from invalid user newuser 103.183.74.214 port 52330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 28 19:53:06 host2 sshd[1986809]: Disconnected from invalid user guest123 52.183.128.237 port 46832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 28 19:52:14 host2 sshd[1986202]: Disconnected from invalid user deamon 138.124.20.112 port 40110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Nov 28 19:52:30 host2 sshd[1986347]: Disconnected from invalid user bob 191.37.72.46 port 53697 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 19:53:11 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51362: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Nov 28 19:53:51 host2 sshd[1987368]: Disconnected from invalid user superset 103.183.74.214 port 40700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 28 19:54:25 host2 sshd[1988271]: Disconnected from invalid user syncuser 52.183.128.237 port 45544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 28 19:54:27 host2 sshd[1988377]: Disconnected from invalid user syncuser 138.124.20.112 port 43620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 28 19:55:29 host2 sshd[1989465]: Disconnected from invalid user sopuser 138.124.20.112 port 50060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-11-28 19:55:37 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:50650: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-28 19:55:13 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:54082: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.20.112
country_id: 798544
description:
Nov 28 19:56:35 host2 sshd[1990228]: Disconnected from invalid user postgres 138.124.20.112 port 59858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Nov 28 19:56:57 host2 sshd[1990586]: Disconnected from invalid user deamon 191.37.72.46 port 13829 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.83.238.32
country_id: 3865483
description:
2025-11-28 19:57:40 dovecot_plain authenticator failed for (UJZECE2W) [191.83.238.32]:56671: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Nov 28 19:59:07 host2 sshd[1992192]: Disconnected from invalid user postgres 103.183.74.214 port 47446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-28 20:00:44 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:39202: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2025-11-28 20:01:02 dovecot_login authenticator failed for (177-172-15-62.user.vivozap.com.br) [177.172.15.103]:59699: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.144.173
country_id: 357994
description:
2025-11-28 20:02:54 dovecot_login authenticator failed for ([41.65.118.172]) [41.239.144.173]:46930: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 28 20:03:40 host2 sshd[1996287]: Disconnected from invalid user fred 52.183.128.237 port 36586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-28 20:03:31 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:56490: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 28 20:05:00 host2 sshd[1997435]: Disconnected from invalid user customer 52.183.128.237 port 35324 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.49.214
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 121.121.49.214 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.159.241.102
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.159.241.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.137.208
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.117.137.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.66.82.38
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 93.66.82.38 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.125.105.134
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 111.125.105.134 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.18.145
country_id: 2921044
description:
2025-11-28 20:09:46 dovecot_login authenticator failed for (ADMIN) [138.199.18.145]:54108: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-28 20:12:06 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:52372: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-28 20:11:42 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51484: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.68.245
country_id: 2921044
description:
Nov 28 20:15:59 host2 pure-ftpd[2006482]: (?@138.68.68.245) [INFO] New connection from 138.68.68.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.159.7
country_id: 2921044
description:
Nov 28 20:15:58 host2 pure-ftpd[2006469]: (?@165.227.159.7) [INFO] New connection from 165.227.159.7


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.33
country_id: 6252001
description:
2025-11-28 20:16:59 dovecot_login authenticator failed for ([98.181.63.33]) [98.181.63.33]:35291: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-28 20:17:08 dovecot_plain authenticator failed for (coaties) [65.20.153.146]:56550: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-11-28 20:17:29 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:52542: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Nov 28 20:18:33 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<thg+uahEsP5BMQGi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.163
country_id: 6252001
description:
Nov 28 20:18:15 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GjkuuKhEsVtBMQGj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-28 20:20:54 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (prideve) [74.218.95.154]:53171: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 20:22:37 host2 sshd[2011612]: Disconnected from invalid user cornelius 62.60.131.157 port 43437 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.90
country_id: 1880251
description:
Nov 28 20:23:09 host2 sshd[2012001]: Disconnected from invalid user oracle 45.78.221.90 port 36788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.33
country_id: 614540
description:
2025-11-28 20:25:15 dovecot_login authenticator failed for (ADMIN) [95.181.236.33]:32435: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 20:27:43 host2 sshd[2015631]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 28 20:30:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<uFtw4qhErN9ChJl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.199
country_id: 6252001
description:
Nov 28 20:34:28 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.199, lip=66.85.158.92, session=<564o8qhEd0hBMQHH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 28 20:34:40 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS: Connection closed, session=<ZZTi8qhE8C1BMQHA>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.95.5
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.95.5 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.169.251
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.53.169.251 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.243.11.4
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.243.11.4 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.1.53
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.38.1.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.211.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.58.211.253 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.128.55.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.128.55.4 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.134.138.48
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.134.138.48 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.134
country_id: 1210997
description:
2025-11-28 20:36:09 dovecot_login authenticator failed for (ADMIN) [64.64.112.134]:43902: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 20:38:47 host2 sshd[2023628]: Disconnected from invalid user admin 2.57.121.112 port 10837 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.248.74.236
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 188.248.74.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.0.180.120
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.0.180.120 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.18.224.119
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.18.224.119 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.36.35
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.137.36.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.217.166.217
country_id: 390903
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.217.166.217 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.178
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.237.121.178 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.215.97.199
country_id: 1512440
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.215.97.199 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-28 20:48:03 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:49796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-28 20:48:36 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:59080: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov 28 20:48:27 host2 pure-ftpd[2029820]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.31
country_id: 3703430
description:
2025-11-28 20:53:37 dovecot_login authenticator failed for (ADMIN) [91.90.126.31]:42486: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Nov 28 21:05:45 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, TLS, session=<yBMOYqlENu1HBobn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 28 21:06:29 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, session=<C6yoZKlEKO1BMRRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 28 21:08:07 host2 sshd[2042609]: Disconnected from invalid user exx 50.225.176.238 port 33092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.100
country_id: 6252001
description:
2025-11-28 21:11:49 dovecot_login authenticator failed for (ADMIN) [158.173.25.100]:9564: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 28 21:13:18 host2 sshd[2046129]: Disconnected from invalid user foundry 38.137.11.10 port 10612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 28 21:15:52 host2 sshd[2047773]: Disconnected from invalid user dockeradmin 50.225.176.238 port 52746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:18:15 host2 sshd[2048966]: Disconnected from invalid user liyang 194.74.196.10 port 47956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 28 21:19:02 host2 sshd[2049343]: Disconnected from invalid user ts2 50.225.176.238 port 40806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:19:21 host2 sshd[2049521]: Disconnected from invalid user manager 194.74.196.10 port 43384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:22:35 host2 sshd[2051419]: Disconnected from invalid user proxyuser 194.74.196.10 port 57122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 28 21:22:42 host2 sshd[2051447]: Disconnected from invalid user usuario2 38.137.11.10 port 4676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:23:34 host2 sshd[2051887]: Disconnected from invalid user devuser 194.74.196.10 port 33672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-28 21:23:55 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (ideric) [73.196.144.25]:45140: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.244.98.249
country_id: 357994
description:
2025-11-28 21:26:08 dovecot_plain authenticator failed for (ZZ7H17CIG) [45.244.98.249]:53775: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.244.98.249
country_id: 357994
description:
2025-11-28 21:26:14 dovecot_login authenticator failed for (ZZ7H17CIG) [45.244.98.249]:53775: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 21:28:35 host2 sshd[2055788]: Disconnected from invalid user cornelius 62.60.131.157 port 37143 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 28 21:29:29 host2 sshd[2056393]: Disconnected from invalid user kapsch 38.137.11.10 port 41422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.110
country_id: 3144096
description:
2025-11-28 21:30:34 dovecot_login authenticator failed for (ADMIN) [46.246.122.110]:49967: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.76.70.47
country_id: 1269750
description:
2025-11-28 21:34:52 dovecot_plain authenticator failed for (Z69Q27X) [106.76.70.47]:57582: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.158.177
country_id: 3469034
description:
2025-11-28 21:37:01 dovecot_login authenticator failed for ([191.59.158.177]) [191.59.158.177]:46138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-28 21:37:22 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3455: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.251.132.2
country_id: 3996063
description:
Nov 28 21:38:14 host2 sshd[2062850]: Disconnected from invalid user techuser 187.251.132.2 port 41716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-28 21:42:02 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:47948: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-28 21:41:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.9
country_id: 2635167
description:
2025-11-28 21:44:48 dovecot_login authenticator failed for (ADMIN) [158.173.23.9]:1323: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 28 21:50:21 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<N0WTAapEYE64affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.6
country_id: 3042225
description:
2025-11-28 21:59:21 dovecot_login authenticator failed for (ADMIN) [91.90.124.6]:23285: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.242
country_id: 6252001
description:
Nov 28 21:59:44 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.150.242, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pSYXI6pEItKi2Jby>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.242
country_id: 6252001
description:
Nov 28 22:00:40 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.242, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<0MRsJqpE+O2i2Jby>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 28 22:00:20 host2 pure-ftpd[2089274]: (?@66.132.153.118) [INFO] New connection from 66.132.153.118


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.251.132.2
country_id: 3996063
description:
Nov 28 22:01:10 host2 sshd[2089653]: Disconnected from invalid user rstudio 187.251.132.2 port 51980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 28 22:02:23 host2 sshd[2090216]: Disconnected from invalid user kingbase 103.117.56.152 port 46642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.177
country_id: 1880251
description:
Nov 28 22:02:31 host2 sshd[2090248]: Disconnected from invalid user usuario1 45.78.205.177 port 54992 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 28 22:03:52 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RKXkMapEOGNAPpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 28 22:04:10 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZB31MqpEqNVAPpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.242
country_id: 6252001
description:
Nov 28 22:04:20 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.242, lip=66.85.158.92, TLS, session=<EgCJM6pE+Oii2Jby>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 28 22:05:12 host2 sshd[2092583]: Disconnected from invalid user amssys 103.117.56.152 port 43746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 28 22:07:50 host2 sshd[2093896]: Disconnected from invalid user qwerty 103.117.56.152 port 58438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-28 22:07:28 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (excloored) [196.47.172.253]:48874: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.251.132.2
country_id: 3996063
description:
Nov 28 22:09:14 host2 sshd[2094874]: Disconnected from invalid user john 187.251.132.2 port 59444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 28 22:09:34 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<H+8jRqpEbw1RvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:10:06 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<H5s0SKpEVKQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:11:11 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<i7UOTKpEnsQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:12:18 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ke4QUKpE/sEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-11-28 22:12:44 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:47370: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-28 22:13:15 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:46816: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:13:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<gFKLU6pEVr8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-28 22:13:12 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:37678: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.247.126
country_id: 290557
description:
2025-11-28 22:13:28 dovecot_login authenticator failed for ([94.207.247.126]) [94.207.247.126]:53494: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-11-28 22:14:18 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:42344: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:15:40 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=</vsXXKpEVoMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.149
country_id: 3077311
description:
2025-11-28 22:16:43 dovecot_login authenticator failed for (ADMIN) [212.102.39.149]:51700: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:16:43 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<GOneX6pE0MoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:17:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<Yt8NY6pERr8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:18:42 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<+UT0ZqpE/pIDgmBb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.31.127.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.31.127.65 - cloudtourssrilanka "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:19:05 host2 dovecot[1796015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5w5TaKpEGpkDgmBb>


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.31.127.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 34.31.127.65 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user travel (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:20:10 host2 dovecot[1796015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<VM0zbKpEqJQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-28 22:20:17 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:40630: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-28 22:20:20 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:45473: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-28 22:20:29 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:55923: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-28 22:20:30 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:44020: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:21:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<nyg0cKpExN0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:22:18 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<xgrVc6pENrADgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.244.98.249
country_id: 357994
description:
2025-11-28 22:22:31 dovecot_plain authenticator failed for (T8FWR3M6R) [45.244.98.249]:60480: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 22:23:50 host2 sshd[2103586]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.223.21.182
country_id: 6252001
description:
Nov 28 22:24:29 host2 pure-ftpd[2104230]: (?@44.223.21.182) [INFO] New connection from 44.223.21.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:30:55 host2 sshd[2107998]: Disconnected from invalid user oracle 38.213.63.12 port 50070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:32:10 host2 sshd[2108583]: Disconnected from invalid user conectar 38.213.63.12 port 58548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 22:32:36 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<r5KKmKpEJNEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:32:43 host2 sshd[2108849]: Disconnected from invalid user bitrix 35.244.25.124 port 49842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-28 22:34:56 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:40750: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:35:50 host2 sshd[2110662]: Disconnected from invalid user intel 35.244.25.124 port 49324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-28 22:35:17 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:41862: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:35:36 host2 sshd[2110547]: Disconnected from invalid user git 38.213.63.12 port 42204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 22:37:40 host2 sshd[2111517]: Disconnected from invalid user admin 2.57.121.112 port 47985 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:38:42 host2 sshd[2112025]: Disconnected from invalid user intel 35.244.25.124 port 47156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:39:10 host2 sshd[2112318]: Disconnected from invalid user admin 38.213.63.12 port 33638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.173.18
country_id: 2921044
description:
2025-11-28 22:40:28 dovecot_login authenticator failed for (ADMIN) [181.214.173.18]:48784: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.218
country_id: 6252001
description:
Nov 28 22:41:11 host2 pure-ftpd[2113917]: (?@198.235.24.218) [INFO] New connection from 198.235.24.218


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:41:24 host2 sshd[2114039]: Disconnected from invalid user es 35.244.25.124 port 44984 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.66
country_id: 6252001
description:
Nov 28 22:43:03 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.66, lip=66.85.158.91, session=<i2ICvqpEpYxomDRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.177
country_id: 1880251
description:
Nov 28 22:43:50 host2 sshd[2115339]: Disconnected from invalid user andy 45.78.205.177 port 39106 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.25
country_id: 6252001
description:
Nov 28 22:48:05 host2 pure-ftpd[2120754]: (?@198.235.24.25) [INFO] New connection from 198.235.24.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-28 22:47:54 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:41274: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-28 22:48:16 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-28 22:55:00 dovecot_login authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:53519: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-28 22:56:41 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:51170: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-28 22:56:21 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:45547: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-28 22:57:25 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:52999: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.126
country_id: 6252001
description:
Nov 28 22:58:32 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.97.5.126, lip=66.85.158.92, session=<LK5e9apEULISYQV+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.144
country_id: 798549
description:
2025-11-28 22:59:24 dovecot_login authenticator failed for (ADMIN) [91.90.120.144]:35334: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 23:00:10 host2 sshd[2130339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.132
country_id: 6252001
description:
Nov 28 23:03:33 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HrJPB6tEPsMs3LyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-28 23:10:13 dovecot_plain authenticator failed for (tutchen) [154.144.243.93]:35430: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-11-28 23:14:52 dovecot_login authenticator failed for (6rDqP2H) [178.16.54.97]:58406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-11-28 23:15:16 dovecot_login authenticator failed for (ql6PtBs) [178.16.54.97]:63149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.17
country_id: 390903
description:
2025-11-28 23:15:58 dovecot_login authenticator failed for (ADMIN) [79.127.181.17]:9015: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-11-28 23:16:50 dovecot_login authenticator failed for (z7saXh7) [178.16.54.97]:65437: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-28 23:24:23 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (cullo) [81.226.88.121]:47250: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov 28 23:25:57 host2 pure-ftpd[2150585]: (?@64.62.156.162) [INFO] New connection from 64.62.156.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.187
country_id: 6252001
description:
Nov 28 23:27:42 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.187, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<54y2XatEYsyi2JW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.187
country_id: 6252001
description:
Nov 28 23:28:40 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.187, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<PrUlYatEAuOi2JW7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.82.240
country_id: 1269750
description:
2025-11-28 23:29:59 dovecot_login authenticator failed for (static.ill.117.247.82.240.bsnl.co.in) [117.247.82.240]:47172: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.94.154
country_id: 1269750
description:
2025-11-28 23:30:11 dovecot_login authenticator failed for ([218.248.0.242]) [14.102.94.154]:42196: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-28 23:32:09 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:54343: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.35
country_id: 953987
description:
2025-11-28 23:33:36 dovecot_login authenticator failed for (ADMIN) [154.47.30.35]:59405: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 28 23:35:00 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<8gvQd6tEkL1ChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.187
country_id: 6252001
description:
Nov 28 23:35:57 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.187, lip=66.85.158.91, TLS, session=<SMo4e6tEivii2JW7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-28 23:37:22 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:34925: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.174.134.37
country_id: 1269750
description:
2025-11-28 23:44:35 dovecot_plain authenticator failed for ([192.168.1.5]) [122.174.134.37]:62024: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:45:38 host2 sshd[2163717]: Disconnected from invalid user bitnami 40.115.18.231 port 59670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:45:51 host2 sshd[2163823]: Disconnected from invalid user desliga 191.189.28.204 port 55856 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.220
country_id: 6252001
description:
Nov 28 23:46:06 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.220, lip=66.85.158.92, session=<y3mBn6tEfsas7OTc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.103.90
country_id: 6252001
description:
Nov 28 23:46:39 host2 sshd[2164290]: Disconnected from invalid user admin1 172.173.103.90 port 49940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 28 23:46:54 host2 sshd[2164491]: Disconnected from invalid user lab 123.58.212.133 port 51240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:48:34 host2 sshd[2165444]: Disconnected from invalid user deploy 191.189.28.204 port 50988 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.195
country_id: 1210997
description:
2025-11-28 23:48:23 dovecot_plain authenticator failed for (Q171B58071) [103.115.252.195]:51776: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:49:35 host2 sshd[2166118]: Disconnected from invalid user mika 155.94.170.106 port 32798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:49:16 host2 sshd[2165818]: Disconnected from invalid user sftpuser 40.115.18.231 port 50276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:50:14 host2 sshd[2166684]: Disconnected from invalid user username 191.189.28.204 port 52104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.103.90
country_id: 6252001
description:
Nov 28 23:50:21 host2 sshd[2166768]: Disconnected from invalid user bot 172.173.103.90 port 51058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:50:24 host2 sshd[2166785]: Disconnected from invalid user bob 40.115.18.231 port 52226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 28 23:50:32 host2 sshd[2166847]: Disconnected from invalid user operador 123.58.212.133 port 47818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:50:35 host2 sshd[2166883]: Disconnected from invalid user dd 155.94.170.106 port 59574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 28 23:51:46 host2 sshd[2167501]: Disconnected from invalid user panda 123.58.212.133 port 51748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.40
country_id: 6252001
description:
2025-11-28 23:51:31 dovecot_login authenticator failed for (ADMIN) [173.244.56.40]:42258: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.127
country_id: 6252001
description:
Nov 28 23:51:38 host2 pure-ftpd[2167432]: (?@198.235.24.127) [INFO] New connection from 198.235.24.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:51:37 host2 sshd[2167420]: Disconnected from invalid user valheim 155.94.170.106 port 58118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:52:42 host2 sshd[2167985]: Disconnected from invalid user deploy 155.94.170.106 port 56668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:52:52 host2 sshd[2168054]: Disconnected from invalid user daniel 40.115.18.231 port 56124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:53:43 host2 sshd[2168624]: Disconnected from invalid user blue 191.189.28.204 port 55934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 23:53:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57329: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.103.90
country_id: 6252001
description:
Nov 28 23:54:20 host2 sshd[2169252]: Disconnected from invalid user ivan 172.173.103.90 port 33702 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.221.58.154
country_id: 6252001
description:
Nov 28 23:56:04 host2 pure-ftpd[2170512]: (?@20.221.58.154) [INFO] New connection from 20.221.58.154


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:55:29 host2 sshd[2170248]: Disconnected from invalid user bodega 191.189.28.204 port 33986 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov 28 23:57:50 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.241, lip=66.85.158.92, TLS, session=<xKJ+yatE5P7N0h/x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.106.30.11
country_id: 3996063
description:
2025-11-28 23:59:26 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [201.106.30.11]:56494: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.8
country_id: 2750405
description:
Nov 28 23:59:29 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 2 secs): user=<>, rip=31.14.32.8, lip=66.85.158.92, TLS, session=<W/5hz6tEp9YfDiAI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-11-29 00:06:34 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (meteram) [68.40.189.43]:45464: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-29 00:07:41 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:36886: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.86
country_id: 3144096
description:
2025-11-29 00:08:35 dovecot_login authenticator failed for (ADMIN) [46.246.122.86]:57573: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.60
country_id: 6252001
description:
Nov 29 00:13:30 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KGGHAaxE6d2TuYQ8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-29 00:13:59 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:46140: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.71
country_id: 1819730
description:
2025-11-29 00:14:12 dovecot_login authenticator failed for (182.239.80.71.hk.chinamobile.com) [182.239.80.71]:59688: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-29 00:13:24 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (xaeduns) [73.176.157.57]:55268: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-29 00:17:23 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:44240: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-11-29 00:17:38 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:36576: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 00:18:59 host2 sshd[2186371]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 00:25:21 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<FaTDK6xEhIYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.222.185.101
country_id: 1880251
description:
Nov 29 00:25:48 host2 sshd[2191453]: Disconnected from invalid user dockeradmin 8.222.185.101 port 54548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:26:59 host2 sshd[2192042]: Disconnected from invalid user vyos 181.212.81.228 port 56568 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 00:28:47 host2 sshd[2192859]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-29 00:29:55 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:43623: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 29 00:33:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, session=<Zg48SKxENmenXpI2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:33:35 host2 sshd[2196489]: Disconnected from invalid user seafile 181.212.81.228 port 46648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2025-11-29 00:37:49 dovecot_login authenticator failed for (ADMIN) [185.225.28.227]:60311: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:37:35 host2 sshd[2199151]: Disconnected from invalid user user5 181.212.81.228 port 42640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-29 00:38:50 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (nonaisum) [73.197.194.98]:56812: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:38:55 host2 sshd[2199772]: Disconnected from invalid user Test 181.212.81.228 port 41300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:45:41 host2 sshd[2204672]: Disconnected from invalid user public 181.212.81.228 port 34622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-29 00:49:53 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.241.234]:58008: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-29 00:50:48 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:45095: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-29 00:51:17 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:57318: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.19
country_id: 2562770
description:
2025-11-29 00:52:40 dovecot_login authenticator failed for (ADMIN) [176.125.230.19]:40860: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 00:54:38 host2 sshd[2211360]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-29 00:54:15 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:59857: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-29 00:54:24 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:41532: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-29 00:56:03 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:43953: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-29 00:56:53 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:60794: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-29 00:57:04 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:41695: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.52
country_id: 99237
description:
2025-11-29 00:59:19 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:48256: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-29 01:08:49 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:51255: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.210
country_id: 6252001
description:
2025-11-29 01:08:51 dovecot_login authenticator failed for (ADMIN) [191.96.67.210]:41872: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 01:09:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9VMiyKxEKKQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 01:09:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<pNouyaxEXIcXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 01:10:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<eie7zKxE+uVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-11-29 01:12:19 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:47198: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-11-29 01:12:43 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:39426: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-29 01:19:59 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:46848: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-11-29 01:20:15 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:40698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.172
country_id: 6252001
description:
Nov 29 01:21:07 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<I61S86xESdHN0h+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-29 01:23:51 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (eappics) [76.157.219.158]:33034: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.240.205.167
country_id: 6252001
description:
2025-11-29 01:23:59 dovecot_login authenticator failed for (ADMIN) [151.240.205.167]:38896: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-29 01:24:53 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:56309: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-29 01:25:20 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:44730: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:27:28 host2 sshd[2232865]: Disconnected from invalid user elsearch 160.187.141.218 port 37904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:27:48 host2 sshd[2233030]: Disconnected from invalid user init 103.252.118.164 port 9672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:30:30 host2 sshd[2234772]: Disconnected from invalid user administrator 103.252.118.164 port 41068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:31:47 host2 sshd[2235409]: Disconnected from invalid user saas 209.141.57.124 port 40114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-11-29 01:33:03 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:48324: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:32:58 host2 sshd[2235913]: Disconnected from invalid user devuser 103.252.118.164 port 5882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-29 01:33:19 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:52434: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:34:13 host2 sshd[2236509]: Disconnected from invalid user pivpn 103.252.118.164 port 3180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-29 01:35:37 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:55167: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:35:17 host2 sshd[2237330]: Disconnected from invalid user ftpuser 209.141.57.124 port 34956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-29 01:35:28 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:35805: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:36:48 host2 sshd[2238288]: Disconnected from invalid user mcserver 103.252.118.164 port 4790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:36:55 host2 sshd[2238367]: Disconnected from invalid user elemental 209.141.57.124 port 34094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:41:39 host2 sshd[2241519]: Disconnected from invalid user casaos 209.141.57.124 port 59752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:43:10 host2 sshd[2242308]: Disconnected from invalid user zjw 209.141.57.124 port 58910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:45:40 host2 sshd[2244762]: Disconnected from invalid user bkp 160.187.141.218 port 53732 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:47:39 host2 sshd[2245761]: Disconnected from invalid user update 160.187.141.218 port 58082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:49:39 host2 sshd[2246808]: Disconnected from invalid user jenkins 160.187.141.218 port 34240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-29 01:52:25 dovecot_plain authenticator failed for (aillocks) [24.187.213.29]:32834: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.187
country_id: 1733045
description:
2025-11-29 01:54:11 dovecot_login authenticator failed for ([49.124.159.187]) [49.124.159.187]:36612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.82
country_id: 6252001
description:
2025-11-29 01:54:20 dovecot_login authenticator failed for ([70.174.168.82]) [70.174.168.82]:41900: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-29 01:57:43 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:33671: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-29 01:57:59 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:51072: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.83
country_id: 6252001
description:
2025-11-29 01:58:59 dovecot_login authenticator failed for (ADMIN) [212.32.49.83]:63136: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Nov 29 02:00:22 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.89, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ivOrf61EwszN0h9Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 29 02:05:32 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<uJokkq1ElLBChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 29 02:10:23 host2 sshd[2261487]: Disconnected from invalid user opc 101.47.51.246 port 33702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:10:44 host2 sshd[2261817]: Disconnected from invalid user ubuntu 148.227.3.232 port 49056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:13:51 host2 sshd[2263830]: Disconnected from invalid user info 45.78.207.230 port 49104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.20
country_id: 6252001
description:
2025-11-29 02:15:22 dovecot_login authenticator failed for (ADMIN) [212.32.49.20]:22387: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 29 02:18:31 host2 sshd[2266465]: Disconnected from invalid user ubuntu 101.47.51.246 port 50830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-29 02:23:14 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:15138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-11-29 02:22:43 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:32774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:24:16 host2 sshd[2269882]: Disconnected from invalid user vpn 45.78.207.230 port 37464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:25:12 host2 sshd[2270646]: Disconnected from invalid user info 148.227.3.232 port 51472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-29 02:25:31 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:36650: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-29 02:25:41 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:51286: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-29 02:26:49 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:47812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 02:26:54 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<nip23q1EgiBRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-29 02:27:01 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:44174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:29:23 host2 sshd[2273375]: Disconnected from invalid user ubuntu 45.78.207.230 port 52246 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:29:57 host2 sshd[2273730]: Disconnected from invalid user ansadmin 148.227.3.232 port 39612 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.46
country_id: 6252001
description:
Nov 29 02:31:25 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.46, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iqu+7q1E3MuTuYQu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:32:24 host2 sshd[2275603]: Disconnected from invalid user vpn 148.227.3.232 port 48460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.21
country_id: 174982
description:
2025-11-29 02:32:34 dovecot_login authenticator failed for (ADMIN) [185.253.160.21]:6601: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:39:35 host2 sshd[2280387]: Disconnected from invalid user mark 45.78.207.230 port 51268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 29 02:41:38 host2 sshd[2282020]: Disconnected from invalid user admin123 101.47.51.246 port 60284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-11-29 02:46:03 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:50154: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-29 02:45:45 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:55138: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-11-29 02:45:50 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:50954: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.177.233.98
country_id: 6252001
description:
Nov 29 02:48:27 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=66.177.233.98, lip=66.85.158.91, TLS, session=<AgiAK65EmOtCseli>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 98.147.132.171
country_id: 6252001
description:
Nov 29 02:48:31 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=98.147.132.171, lip=66.85.158.91, TLS, session=<S+S7K65Exppik4Sr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.43
country_id: 660013
description:
2025-11-29 02:49:22 dovecot_login authenticator failed for (ADMIN) [188.126.89.43]:51402: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 02:51:05 host2 sshd[2288258]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.233.203
country_id: 2921044
description:
Nov 29 02:51:28 host2 pure-ftpd[2288412]: (?@46.101.233.203) [INFO] New connection from 46.101.233.203


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.143.235
country_id: 2921044
description:
Nov 29 02:51:29 host2 pure-ftpd[2288416]: (?@165.227.143.235) [INFO] New connection from 165.227.143.235


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.202.34.38
country_id: 1831722
description:
Nov 29 02:57:00 host2 pure-ftpd[2292179]: (?@160.202.34.38) [INFO] New connection from 160.202.34.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-29 02:59:56 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:61950: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 03:07:13 host2 sshd[2298886]: Disconnected from invalid user admin 2.57.121.112 port 34883 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-29 03:08:40 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:37310: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-29 03:08:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:38968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.59
country_id: 2635167
description:
Nov 29 03:12:45 host2 pure-ftpd[2302158]: (?@185.247.137.59) [INFO] New connection from 185.247.137.59


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 29 03:15:40 host2 sshd[2304054]: Disconnected from invalid user debianuser 103.248.120.6 port 37030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 03:17:57 host2 sshd[2305334]: Disconnected from invalid user admin 2.57.121.112 port 17667 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 29 03:20:58 host2 sshd[2307231]: Disconnected from invalid user ubuntu 103.248.120.6 port 59420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 03:21:36 host2 sshd[2307547]: Disconnected from invalid user brycen 62.60.131.157 port 61907 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.235
country_id: 6252001
description:
2025-11-29 03:26:33 dovecot_login authenticator failed for (ADMIN) [102.129.252.235]:60696: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-29 03:27:53 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-29 03:28:08 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46162: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-11-29 03:31:38 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:60606: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-29 03:31:50 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:57900: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.144.173
country_id: 357994
description:
2025-11-29 03:32:01 dovecot_plain authenticator failed for (pecosimis) [41.239.144.173]:39074: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 03:36:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51723: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.69
country_id: 2963597
description:
2025-11-29 03:39:49 dovecot_login authenticator failed for (ADMIN) [155.2.194.69]:36455: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-29 03:44:15 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:43582: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-29 03:44:30 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:59662: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 29 03:47:14 host2 sshd[2325344]: Disconnected from invalid user rstudio 164.90.225.61 port 39480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 03:49:41 host2 sshd[2327366]: Disconnected from invalid user gerrit 74.249.6.90 port 41026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 29 03:49:20 host2 sshd[2327214]: Disconnected from invalid user admin123 164.90.225.61 port 47196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 03:54:29 host2 sshd[2331734]: Disconnected from invalid user supermaint 74.249.6.90 port 46444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-11-29 03:56:07 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:57542: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-29 03:56:30 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:60108: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.111
country_id: 3996063
description:
2025-11-29 03:57:39 dovecot_login authenticator failed for (ADMIN) [77.81.142.111]:58544: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 03:59:27 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<NOt1Ka9EBogXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 29 04:05:52 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<26FeQK9EasSSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 04:06:59 host2 sshd[2344911]: Disconnected from invalid user admin123 74.249.6.90 port 56806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-11-29 04:10:57 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:46716: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 04:15:34 host2 sshd[2353879]: Disconnected from invalid user sopuser 74.249.6.90 port 44304 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 04:17:55 host2 sshd[2356332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.104
country_id: 3865483
description:
2025-11-29 04:18:08 dovecot_login authenticator failed for (ADMIN) [146.70.38.104]:1373: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-29 04:18:49 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:13215: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-29 04:19:13 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:49220: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-11-29 04:19:35 dovecot_login authenticator failed for (76.73.197.124.unknown.m1.com.sg) [124.197.73.76]:34746: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-11-29 04:19:40 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:46048: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-11-29 04:19:20 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:42690: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-29 04:22:56 dovecot_plain authenticator failed for (nucabocal) [65.20.174.63]:51615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 04:23:27 host2 sshd[2360865]: Disconnected from invalid user bob 74.249.6.90 port 55962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 04:28:49 host2 sshd[2367369]: Disconnected from invalid user admin 2.57.121.112 port 18255 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.208.44.62
country_id: 3469034
description:
[2025-11-29 04:28:50 +0530] info [whostmgrd] 179.208.44.62 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.174.195
country_id: 3469034
description:
[2025-11-29 04:28:50 +0530] info [cpaneld] 45.178.174.195 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:34:17 host2 sshd[2371302]: Disconnected from invalid user adam 205.185.126.121 port 43044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 29 04:36:35 host2 sshd[2372923]: Disconnected from invalid user tempuser 132.145.213.106 port 44150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.48
country_id: 953987
description:
2025-11-29 04:36:42 dovecot_login authenticator failed for (ADMIN) [154.47.30.48]:2468: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:36:44 host2 sshd[2373002]: Disconnected from invalid user test 205.185.126.121 port 55992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:37:32 host2 sshd[2373496]: Disconnected from invalid user postgres 156.236.75.64 port 38374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:37:58 host2 sshd[2373724]: Disconnected from invalid user ubuntu 205.185.126.121 port 54920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:39:10 host2 sshd[2374327]: Disconnected from invalid user testuser 205.185.126.121 port 53848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 04:39:26 host2 sshd[2374562]: Disconnected from invalid user admin 2.57.121.112 port 45532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:40:36 host2 sshd[2375403]: Disconnected from invalid user jacob 156.236.75.64 port 41366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:41:28 host2 sshd[2375835]: Disconnected from invalid user debian 205.185.126.121 port 51708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 29 04:41:59 host2 sshd[2376117]: Disconnected from invalid user debianuser 152.32.189.21 port 53890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2025-11-29 04:42:43 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:43869: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-29 04:42:58 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:4341: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Nov 29 04:43:15 host2 sshd[2376998]: Disconnected from invalid user deamon 190.129.122.120 port 39242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:43:27 host2 sshd[2377129]: Disconnected from invalid user radio 156.236.75.64 port 40790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 29 04:45:18 host2 sshd[2378670]: Disconnected from invalid user newuser 132.145.213.106 port 46290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 29 04:45:47 host2 sshd[2379474]: Disconnected from invalid user zmarin 152.32.189.21 port 59806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:46:18 host2 sshd[2380081]: Disconnected from invalid user jacob 156.236.75.64 port 52682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 29 04:47:44 host2 sshd[2381037]: Disconnected from invalid user adam 132.145.213.106 port 49618 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:26 host2 sshd[2383526]: Disconnecting authenticating user root 45.44.153.69 port 53357: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:26 host2 sshd[2383526]: error: maximum authentication attempts exceeded for root from 45.44.153.69 port 53357 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:34 host2 sshd[2383634]: error: maximum authentication attempts exceeded for invalid user admin from 45.44.153.69 port 53868 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:36 host2 sshd[2383651]: Disconnecting invalid user admin 45.44.153.69 port 53988: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 29 04:51:43 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, TLS: Connection closed, session=<B5Z95K9EkAinXpI2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Nov 29 04:52:20 host2 sshd[2384937]: Disconnected from invalid user fred 190.129.122.120 port 55458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.50
country_id: 732800
description:
2025-11-29 04:52:39 dovecot_login authenticator failed for (ADMIN) [94.156.14.50]:50916: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 29 04:53:15 host2 sshd[2385579]: Disconnected from invalid user intell 152.32.189.21 port 37582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.122.120
country_id: 3923057
description:
Nov 29 04:53:48 host2 sshd[2385896]: Disconnected from invalid user postgres 190.129.122.120 port 39488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-29 04:58:27 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:33352: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-11-29 04:59:08 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:35267: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.229.156
country_id: 6252001
description:
Nov 29 05:03:25 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.255.229.156, lip=66.85.158.92, session=<N4VMDrBEkNit/+Wc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.196.226
country_id: 6252001
description:
Nov 29 05:03:25 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=206.189.196.226, lip=66.85.158.92, session=<WBpVDrBERNrOvcTi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-29 05:05:07 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:34990: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-29 05:05:25 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:54790: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-11-29 05:05:39 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:48256: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.172
country_id: 2623032
description:
2025-11-29 05:09:05 dovecot_login authenticator failed for (ADMIN) [188.126.94.172]:58689: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-29 05:10:29 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (sipsic) [174.59.253.88]:56612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-11-29 05:10:26 dovecot_plain authenticator failed for (bachemnos) [149.62.239.4]:49920: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.205.151.247
country_id: 6252001
description:
Nov 29 05:11:30 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=67.205.151.247, lip=66.85.158.92, session=<gnI0K7BEKrlDzZf3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-29 05:16:26 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:59404: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-29 05:16:37 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:40594: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.60.158
country_id: 6252001
description:
Nov 29 05:17:54 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.60.158, lip=66.85.158.91, session=<qOUhQrBExIwtITye>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.239.4.152
country_id: 6252001
description:
Nov 29 05:17:54 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=23.239.4.152, lip=66.85.158.91, session=<m0EdQrBEsrQX7wSY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.109.86
country_id: 6252001
description:
Nov 29 05:21:03 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=137.184.109.86, lip=66.85.158.91, session=<S89jTbBEHImJuG1W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.127
country_id: 6252001
description:
Nov 29 05:25:58 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.127, lip=66.85.158.91, TLS: Connection closed, session=<4b33XrBErPjHLZp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 05:27:19 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<DjWuY7BERExRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-29 05:27:55 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:34688: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-11-29 05:28:09 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:49667: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-29 05:31:00 dovecot_plain authenticator failed for (uncoldne) [84.238.92.245]:38045: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-29 05:36:49 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:50682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-11-29 05:39:48 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:35266: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-11-29 05:39:34 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:53948: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.164
country_id: 2623032
description:
2025-11-29 05:43:28 dovecot_login authenticator failed for (ADMIN) [188.126.94.164]:26481: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 05:48:37 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<NY/cr7BEDqsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-11-29 05:53:04 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:51261: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-11-29 05:53:46 dovecot_login authenticator failed for ([103.245.109.37]) [103.245.109.37]:36460: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.34
country_id: 2186224
description:
2025-11-29 06:02:04 dovecot_login authenticator failed for (ADMIN) [179.61.240.34]:16596: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.83
country_id: 1861060
description:
2025-11-29 06:20:14 dovecot_login authenticator failed for (ADMIN) [149.22.87.83]:7558: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.67
country_id: 6252001
description:
Nov 29 06:22:54 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AOiMKrFEFNbG6xhD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:24:50 host2 sshd[2450268]: Disconnected from invalid user osboxes 45.78.203.176 port 42566 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 06:28:51 host2 sshd[2452524]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.146.164
country_id: 3469034
description:
2025-11-29 06:34:33 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:39290: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-29 06:35:04 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:37962: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-11-29 06:34:23 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:36360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:34:28 host2 sshd[2455984]: Disconnected from invalid user amssys 45.78.203.176 port 36550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-11-29 06:35:17 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:39826: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.50.36
country_id: 298795
description:
2025-11-29 06:35:42 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:36846: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 06:37:23 host2 sshd[2457926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.207
country_id: 6252001
description:
2025-11-29 06:37:34 dovecot_login authenticator failed for (ADMIN) [173.244.56.207]:18340: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-29 06:37:58 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:39652: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:40:04 host2 sshd[2459269]: Disconnected from invalid user dmdba 45.78.203.176 port 40470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-29 06:40:11 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:33689: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Nov 29 06:39:10 host2 sshd[2458884]: Disconnected from invalid user alex 101.47.48.255 port 56480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Nov 29 06:42:46 host2 sshd[2461364]: Disconnected from invalid user user1 101.47.48.255 port 41346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-29 06:43:32 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:47880: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-29 06:43:46 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:48650: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 06:47:29 host2 sshd[2464924]: Disconnected from invalid user johana 62.60.131.157 port 46430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:49:46 host2 sshd[2466372]: Disconnected from invalid user system 45.78.203.176 port 42508 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.38
country_id: 2635167
description:
Nov 29 06:51:08 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS, session=<RquPj7FEr+K594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.111
country_id: 2635167
description:
Nov 29 06:51:18 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.111, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cQ0jkLFEt+O594lv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.131
country_id: 2635167
description:
Nov 29 06:51:51 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.131, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SnIekrFEhZpX7LCD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Nov 29 06:52:24 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<MfgZlLFErcVX7LBy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.142
country_id: 2635167
description:
Nov 29 06:52:58 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.142, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<jDsVlrFEVYy594mO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.133
country_id: 2635167
description:
Nov 29 06:54:04 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.133, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AygKmrFERdVX7LCF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.119
country_id: 2635167
description:
Nov 29 06:53:31 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.119, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Z7kQmLFEq4u594l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.121
country_id: 2635167
description:
Nov 29 06:54:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.121, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5Z0HnLFEQdFX7LB5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.128
country_id: 2635167
description:
Nov 29 06:55:44 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<P238n7FEY9C594mA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.129
country_id: 2635167
description:
Nov 29 06:55:11 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.129, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<6vwCnrFEidZX7LCB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-29 06:56:54 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:58550: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-29 06:57:05 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:42906: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Nov 29 06:56:17 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<J8r3obFE8blX7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 06:59:47 host2 sshd[2472706]: Disconnected from invalid user johana 62.60.131.157 port 13115 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 08:15:55 host2 sshd[2479174]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-29 08:16:51 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:38356: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-29 08:17:27 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br ([187.126.105.145]) [187.126.105.42]:50109: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-29 08:17:28 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:45231: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.77
country_id: 2186224
description:
2025-11-29 08:17:51 dovecot_login authenticator failed for ([121.73.169.77]) [121.73.169.77]:45928: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-29 08:17:50 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:58280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.65
country_id: 6252001
description:
Nov 29 08:19:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.132.65, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3eMbyrJEMtSTuYRB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.65
country_id: 6252001
description:
Nov 29 08:19:26 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.65, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7ddTy7JEkv6TuYRB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.113.208.46
country_id: 6252001
description:
2025-11-29 08:21:06 dovecot_login authenticator failed for 46.208.113.136.bc.googleusercontent.com [136.113.208.46]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-29 08:21:35 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:55132: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.26
country_id: 2963597
description:
2025-11-29 08:23:22 dovecot_login authenticator failed for (ADMIN) [155.2.194.26]:17777: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.65
country_id: 6252001
description:
Nov 29 08:24:10 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.65, lip=66.85.158.92, TLS, session=<1cNA3LJEavuTuYRB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 08:24:28 host2 sshd[2484267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-29 08:26:32 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:57484: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-29 08:26:47 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:41340: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-29 08:37:02 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (sporesood) [98.204.134.124]:36488: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.87
country_id: 6252001
description:
Nov 29 08:37:04 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.87, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5i5gCrNEtsrN0h9X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-11-29 08:44:30 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:50182: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 08:53:40 host2 sshd[2503578]: Disconnected from invalid user jenkins 161.132.68.201 port 48642 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 29 08:58:39 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<qO+ZV7NEIQkt4/6Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.69.233.26
country_id: 1835841
description:
Nov 29 08:59:46 host2 sshd[2507235]: Disconnected from invalid user testuser 152.69.233.26 port 35444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 09:00:03 host2 sshd[2507483]: Disconnected from invalid user node 161.132.68.201 port 55766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 09:02:43 host2 sshd[2509015]: Disconnected from invalid user ventas01 161.132.68.201 port 39456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.69.233.26
country_id: 1835841
description:
Nov 29 09:04:00 host2 sshd[2509968]: Disconnected from invalid user zimbra 152.69.233.26 port 44958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 09:05:19 host2 sshd[2510804]: Disconnected from invalid user test 161.132.68.201 port 51958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-29 09:06:52 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:43756: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-29 09:07:02 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:45104: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.117
country_id: 6252001
description:
Nov 29 09:14:44 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.117, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D4UWkbNEMdaTuYR1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.17
country_id: 2921044
description:
2025-11-29 09:15:30 dovecot_login authenticator failed for (ADMIN) [191.101.157.17]:48162: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-29 09:18:51 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:54320: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-29 09:19:01 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37060: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-11-29 09:21:02 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:51138: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-29 09:21:09 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:55002: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-29 09:21:20 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:49640: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:22:20 host2 sshd[2521037]: Disconnected from invalid user fiscal 34.69.0.72 port 54386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.69.233.26
country_id: 1835841
description:
Nov 29 09:22:33 host2 sshd[2521127]: Disconnected from invalid user node 152.69.233.26 port 45508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:29:38 host2 sshd[2525923]: Disconnected from invalid user marco 34.69.0.72 port 42428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-29 09:30:49 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:34447: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-11-29 09:31:06 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:33282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:32:12 host2 sshd[2528182]: Disconnected from invalid user bot 34.69.0.72 port 54696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.94
country_id: 2635167
description:
2025-11-29 09:32:28 dovecot_login authenticator failed for (ADMIN) [158.173.24.94]:13457: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:33:30 host2 sshd[2528992]: Disconnected from invalid user admin1234 34.69.0.72 port 48012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:42:35 host2 sshd[2535340]: Disconnected from invalid user a 118.26.36.195 port 39202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 29 09:46:03 host2 sshd[2538883]: Disconnected from invalid user rstudio 206.189.130.118 port 60256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:45:42 host2 sshd[2538570]: Disconnected from invalid user opc 118.26.36.195 port 55156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Nov 29 09:45:56 host2 sshd[2538725]: Disconnected from invalid user testadmin 69.5.0.120 port 60820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.200.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.200.40 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-29 09:47:41 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:45662: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-11-29 09:47:56 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:58458: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:48:02 host2 sshd[2540030]: Disconnected from invalid user rstudio 118.26.36.195 port 40630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Nov 29 09:48:07 host2 sshd[2540104]: Disconnected from invalid user devuser 69.5.0.120 port 59588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.28
country_id: 718075
description:
2025-11-29 09:48:13 dovecot_login authenticator failed for (ADMIN) [185.225.31.28]:15110: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:50:23 host2 sshd[2541552]: Disconnected from invalid user ts2 118.26.36.195 port 46558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-11-29 09:50:52 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:48736: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-29 09:51:26 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56722: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 29 09:52:26 host2 sshd[2542821]: Disconnected from invalid user maarch 206.189.130.118 port 59852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 29 09:53:41 host2 sshd[2543614]: Disconnected from invalid user sipv 206.189.130.118 port 54460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 09:56:16 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<+CGEJbREEvhRvaKO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 10:03:23 host2 sshd[2552107]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-11-29 10:05:11 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:39668: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-29 10:05:33 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:34458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.142
country_id: 3017382
description:
2025-11-29 10:06:30 dovecot_login authenticator failed for (ADMIN) [156.146.63.142]:44173: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 29 10:07:51 host2 sshd[2554756]: Disconnected from invalid user castle 36.95.194.54 port 43808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:09:03 host2 sshd[2555443]: Disconnected from invalid user kyt 51.178.141.222 port 47182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:10:12 host2 sshd[2556481]: Disconnected from invalid user usuario2 104.168.103.115 port 51582 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 10:12:05 host2 sshd[2557498]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 29 10:12:03 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<U5b3XbREppqSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:12:14 host2 sshd[2557552]: Disconnected from invalid user redmine 51.178.141.222 port 44428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 29 10:12:26 host2 sshd[2557654]: Disconnected from invalid user testuser 75.159.69.29 port 57688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 29 10:13:32 host2 sshd[2558252]: Disconnected from invalid user openbravo 36.95.194.54 port 34110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:13:52 host2 sshd[2558460]: Disconnected from invalid user gns3 104.168.103.115 port 38696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:16:04 host2 sshd[2559925]: Disconnected from invalid user super 104.168.103.115 port 55318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:17:21 host2 sshd[2560587]: Disconnected from invalid user cc 104.168.103.115 port 34684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:17:55 host2 sshd[2560826]: Disconnected from invalid user userroot 51.178.141.222 port 54844 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:17:38 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AbsRcrREQK8DhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 29 10:17:39 host2 sshd[2560718]: Disconnected from invalid user openbravo 75.159.69.29 port 39084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Nov 29 10:18:54 host2 sshd[2561389]: Disconnected from invalid user sipv 69.5.0.120 port 42438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 29 10:18:56 host2 sshd[2561429]: Disconnected from invalid user kapsch 75.159.69.29 port 41486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:18:58 host2 sshd[2561458]: Disconnected from invalid user zhangsan 51.178.141.222 port 56904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.217
country_id: 6252001
description:
2025-11-29 10:20:23 dovecot_login authenticator failed for (ADMIN) [181.214.166.217]:60638: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:21:13 host2 sshd[2563278]: Disconnected from invalid user autrede 51.178.141.222 port 32814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:21:33 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<evUJgLREAIUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.244
country_id: 3017382
description:
Nov 29 10:23:57 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.244, lip=66.85.158.91, session=<D6iqiLRExbZb51n0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:23:58 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Vy6viLRE2OkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.140
country_id: 3017382
description:
Nov 29 10:23:34 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.140, lip=66.85.158.91, session=<mfxJh7REr5lb51mM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.243
country_id: 3017382
description:
Nov 29 10:23:45 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.243, lip=66.85.158.91, session=<nxfnh7RE+YNb51nz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:25:38 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7D2ijrREspgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:27:09 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<nlsQlLRENOkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:27:34 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<34mMlbREmskDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.64
country_id: 3017382
description:
2025-11-29 10:34:26 dovecot_login authenticator failed for (ADMIN) [191.101.31.64]:47711: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:44:07 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<sCfK0LREh88jy9Iz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:45:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<GMwu1LRE7PAjy9Iz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.2
country_id: 2635167
description:
Nov 29 10:44:57 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.2, lip=66.85.158.92, TLS, session=<vFW+07RE1ZVX7LAC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:45:29 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<drKh1bRE8Pkjy9Iz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:50:51 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS, session=<gc/d6LREku8jy9Iz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:51:24 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS, session=<mQPQ6rREgugjy9Iz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 10:53:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52657: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.38
country_id: 6252001
description:
2025-11-29 10:53:37 dovecot_login authenticator failed for (ADMIN) [158.173.25.38]:8757: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-29 10:56:07 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:53636: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-29 10:56:17 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:35499: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 11:00:31 host2 sshd[2587620]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:07:19 host2 sshd[2592162]: Disconnected from invalid user media 103.179.27.94 port 35176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:08:54 host2 sshd[2593141]: Disconnected from invalid user root1 103.179.27.94 port 36352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:09:20 host2 sshd[2593419]: Disconnected from invalid user local 45.78.228.30 port 40202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.57
country_id: 6251999
description:
2025-11-29 11:10:14 dovecot_login authenticator failed for (ADMIN) [212.56.52.57]:44962: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:10:30 host2 sshd[2594497]: Disconnected from invalid user vyos 103.179.27.94 port 49428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-11-29 11:12:10 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:44876: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-29 11:12:00 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:54377: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Nov 29 11:13:53 host2 sshd[2596836]: Disconnected from invalid user terraria 202.8.127.134 port 46608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:15:00 host2 sshd[2597411]: Disconnected from invalid user devuser 103.179.27.94 port 53058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-29 11:15:28 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:37360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-29 11:15:35 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:38254: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:16:43 host2 sshd[2598661]: Disconnected from invalid user ventas01 45.78.228.30 port 42068 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Nov 29 11:16:36 host2 sshd[2598611]: Disconnected from invalid user khan 202.8.127.134 port 44170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-11-29 11:17:25 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:54873: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.60.131.153
country_id: 130758
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 62.60.131.153 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-29 11:17:14 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:52242: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:19:08 host2 sshd[2599869]: Disconnected from invalid user ubuntu 45.78.228.30 port 51596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Nov 29 11:20:40 host2 sshd[2601113]: Disconnected from invalid user rstudio 202.8.127.134 port 40520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.154
country_id: 6252001
description:
2025-11-29 11:20:10 dovecot_plain authenticator failed for ([10.25.18.229]) [84.239.7.154]:51584: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:28:41 host2 sshd[2605601]: Disconnected from invalid user sammy 45.78.228.30 port 49898 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 29 11:29:10 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<8YXgcbVE6OcjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.252
country_id: 3469034
description:
2025-11-29 11:30:26 dovecot_login authenticator failed for (ADMIN) [188.241.177.252]:58084: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-11-29 11:31:51 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:35699: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-29 11:32:06 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:59750: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov 29 11:32:06 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.234, lip=66.85.158.92, session=<lXhVfLVEbPSTuYTq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 11:33:10 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<c+MRgLVENooXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:44:41 host2 sshd[2615580]: Disconnected from invalid user deploy 150.5.129.10 port 45508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.87
country_id: 2635167
description:
2025-11-29 11:46:18 dovecot_login authenticator failed for (ADMIN) [158.173.24.87]:18804: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:47:33 host2 sshd[2617754]: Disconnected from invalid user ts 150.5.129.10 port 60158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:48:54 host2 sshd[2618449]: Disconnected from invalid user ftp1 150.5.129.10 port 59066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:50:10 host2 sshd[2619406]: Disconnected from invalid user peter 150.5.129.10 port 57968 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 11:51:25 host2 sshd[2620121]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-29 11:51:28 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:50486: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:51:31 host2 sshd[2620157]: Disconnected from invalid user intell 150.5.129.10 port 56924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-29 11:51:14 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:36206: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-29 11:52:14 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:59941: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 11:52:38 host2 sshd[2620721]: Disconnected from invalid user ansible 188.166.232.44 port 45268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 11:52:45 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<LEQSxrVELxJRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:53:41 host2 sshd[2621254]: Disconnected from invalid user manager 143.110.186.36 port 54632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:55:03 host2 sshd[2622730]: Disconnected from invalid user toto 143.110.186.36 port 58768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:56:25 host2 sshd[2623539]: Disconnected from invalid user rahul 143.110.186.36 port 60790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:57:46 host2 sshd[2624268]: Disconnected from invalid user marvin 143.110.186.36 port 55452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 11:57:51 host2 sshd[2624314]: Disconnected from invalid user liyang 188.166.232.44 port 46402 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 12:00:00 host2 sshd[2625542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 11:59:08 host2 sshd[2624966]: Disconnected from invalid user manager 188.166.232.44 port 45240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 12:00:26 host2 sshd[2626008]: Disconnected from invalid user copia 188.166.232.44 port 44080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-29 12:00:49 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:59172: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-29 12:01:24 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:38392: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.24
country_id: 3194884
description:
2025-11-29 12:05:42 dovecot_login authenticator failed for (ADMIN) [176.125.229.24]:24577: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-29 12:06:00 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:57408: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-29 12:06:11 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:48142: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Nov 29 12:06:48 host2 sshd[2629727]: Disconnected from invalid user user1 45.78.230.104 port 35830 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.226.72
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.226.72 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Nov 29 12:09:06 host2 sshd[2630908]: Disconnected from invalid user student 45.78.230.104 port 43402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-29 12:09:34 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:32946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-29 12:09:46 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:45355: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-11-29 12:09:55 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4167: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.149
country_id: 2661886
description:
2025-11-29 12:09:13 dovecot_login authenticator failed for 95.209.141.149.bredband.tre.se [95.209.141.149]:35402: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.238
country_id: 6252001
description:
Nov 29 12:11:07 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.238, lip=66.85.158.92, TLS, session=<RHXoB7ZEnPDN0h/u>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.104
country_id: 1880251
description:
Nov 29 12:11:25 host2 sshd[2632529]: Disconnected from invalid user rich 45.78.230.104 port 43976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 18.185.102.224
country_id: 2921044
description:
Nov 29 12:12:14 host2 sshd[2632912]: Disconnected from invalid user builder 18.185.102.224 port 39006 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.42
country_id: 1819730
description:
Nov 29 12:16:11 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.42, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Mg4DGrZE8tstjpoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-29 12:18:29 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:32964: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-29 12:19:06 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:40166: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:20:19 host2 sshd[2637756]: Disconnected from invalid user sammy 103.249.84.18 port 45098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:23:43 host2 sshd[2639525]: Disconnected from invalid user student 103.249.84.18 port 47828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-29 12:25:37 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:58459: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:25:11 host2 sshd[2640519]: Disconnected from invalid user sammy 103.249.84.18 port 35384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.131
country_id: 1210997
description:
2025-11-29 12:26:47 dovecot_login authenticator failed for (ADMIN) [64.64.112.131]:60113: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:27:54 host2 sshd[2642000]: Disconnected from invalid user ubuntu 103.249.84.18 port 52088 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 171.225.223.108
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 171.225.223.108: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.136
country_id: 2921044
description:
2025-11-29 12:42:38 dovecot_login authenticator failed for (ADMIN) [191.101.157.136]:41708: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-29 12:48:48 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:49714: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-29 12:49:09 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:55496: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-11-29 12:53:46 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:50642: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-11-29 12:53:33 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:40508: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Nov 29 12:54:16 host2 pure-ftpd[2658116]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-29 12:55:41 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:46631: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.23
country_id: 1227603
description:
2025-11-29 12:59:11 dovecot_login authenticator failed for (ADMIN) [95.181.239.23]:33692: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 13:00:39 host2 sshd[2662210]: Disconnected from invalid user marcella 62.60.131.157 port 14005 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-29 13:01:33 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:13781: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-29 13:01:54 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:37576: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.195.143
country_id: 6252001
description:
Nov 29 13:07:50 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.195.143, lip=66.85.158.92, session=<JqS30rZEguKs6cOP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 13:13:42 host2 sshd[2670547]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-11-29 13:16:34 dovecot_login authenticator failed for (182.239.78.55.hk.chinamobile.com) [182.239.78.55]:45269: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-11-29 13:16:47 dovecot_login authenticator failed for ([128.185.217.150]) [125.19.157.158]:60972: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.18
country_id: 2589581
description:
2025-11-29 13:16:09 dovecot_login authenticator failed for (ADMIN) [176.125.228.18]:11309: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.30
country_id: 6252001
description:
Nov 29 13:17:09 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.30, lip=66.85.158.91, TLS, session=<yZ4O9LZEsvqTuYQe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-29 13:27:21 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:57432: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-29 13:28:52 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:42838: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-29 13:31:21 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:53959: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.7
country_id: 2993457
description:
2025-11-29 13:35:25 dovecot_login authenticator failed for (ADMIN) [95.181.233.7]:15350: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 13:38:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<XA61PrdEGLMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 13:38:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4Y/VP7dETNIXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 13:39:28 host2 sshd[2685673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-29 13:44:42 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:59819: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 13:44:48 host2 sshd[2688528]: Disconnected from invalid user  2.57.121.112 port 61612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-29 13:45:04 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:52632: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 13:48:03 host2 sshd[2691093]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.239.208.223
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 91.239.208.223 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.19.37
country_id: 2921044
description:
2025-11-29 13:52:16 dovecot_login authenticator failed for (ADMIN) [138.199.19.37]:5764: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-29 13:54:19 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:43874: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-29 13:54:33 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:9612: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-29 13:56:46 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:50484: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-29 13:57:05 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:56992: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-29 13:57:30 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:40472: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-29 13:57:47 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:33263: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-29 13:57:46 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:59536: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.91
country_id: 6252001
description:
2025-11-29 13:58:04 dovecot_login authenticator failed for ([70.174.168.91]) [70.174.168.91]:37736: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 14:01:01 host2 sshd[2698689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-29 14:01:47 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:33469: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:04:16 host2 sshd[2700997]: Disconnected from invalid user gg 179.32.207.251 port 58156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-29 14:04:51 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:45532: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-29 14:05:10 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:53613: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 14:06:06 host2 sshd[2702014]: Disconnected from invalid user  2.57.121.112 port 61299 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 29 14:06:42 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<oN0kpbdEbOZ283VD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.55
country_id: 6252001
description:
Nov 29 14:07:25 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.55, lip=66.85.158.91, TLS, session=<zknRp7dE/PPN0h83>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.15
country_id: 3175395
description:
2025-11-29 14:07:31 dovecot_login authenticator failed for (ADMIN) [156.146.41.15]:50886: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:08:42 host2 sshd[2703466]: Disconnected from invalid user old 179.32.207.251 port 38202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-29 14:09:55 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:55726: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:09:57 host2 sshd[2704103]: Disconnected from invalid user sipv 179.32.207.251 port 40468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-29 14:10:10 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:39218: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.202.145
country_id: 6252001
description:
Nov 29 14:10:47 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.118.202.145, lip=66.85.158.92, session=<0TnZs7dECuMUdsqR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:11:15 host2 sshd[2704942]: Disconnected from invalid user testuser 179.32.207.251 port 42722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 14:12:06 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Y2p3uLdElmlRvaKO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.83.162.167
country_id: 1168579
description:
Nov 29 14:20:23 host2 sshd[2709951]: Disconnected from invalid user kafka 202.83.162.167 port 36264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:20:58 host2 sshd[2710304]: Disconnected from invalid user weblogic 104.168.56.59 port 36972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:23:10 host2 sshd[2711836]: Disconnected from invalid user debianuser 104.168.56.59 port 33606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.14
country_id: 174982
description:
2025-11-29 14:25:02 dovecot_login authenticator failed for (ADMIN) [185.253.160.14]:31158: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:24:15 host2 sshd[2712864]: Disconnected from invalid user jenkins 104.168.56.59 port 44556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 14:25:17 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<lGWV57dEqKoXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:25:24 host2 sshd[2714066]: Disconnected from invalid user elastic 104.168.56.59 port 50064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:26:30 host2 sshd[2714822]: Disconnected from invalid user zhangsan 104.168.56.59 port 45388 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.157
country_id: 6252001
description:
Nov 29 14:27:21 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.104.157, lip=66.85.158.92, session=<zBwb77dE0JWsymid>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.90
country_id: 6252001
description:
Nov 29 14:28:11 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.90, lip=66.85.158.91, session=<UFsc8rdEzowofK1a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 14:29:27 host2 sshd[2716974]: Disconnected from invalid user tristan 62.60.131.157 port 26695 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.225.72
country_id: 6252001
description:
Nov 29 14:31:18 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.15.225.72, lip=66.85.158.91, session=<hkk+/bdEPL4UD+FI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.236
country_id: 1733045
description:
2025-11-29 14:32:31 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:51652: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-29 14:33:00 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-29 14:35:43 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:52848: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-29 14:35:56 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:38059: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.155
country_id: 3077311
description:
2025-11-29 14:39:08 dovecot_login authenticator failed for (ADMIN) [212.102.39.155]:12315: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 14:39:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54455: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.118
country_id: 6252001
description:
Nov 29 14:42:09 host2 pure-ftpd[2725449]: (?@147.185.132.118) [INFO] New connection from 147.185.132.118


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 14:51:03 host2 sshd[2731579]: Disconnected from invalid user user 101.36.116.29 port 42134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:51:32 host2 sshd[2731906]: Disconnected from invalid user ftptest 85.133.253.204 port 54746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.203.52
country_id: 6252001
description:
Nov 29 14:51:45 host2 sshd[2732103]: Disconnected from invalid user ivan 167.172.203.52 port 38970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 29 14:51:18 host2 sshd[2731781]: Disconnected from invalid user test 209.141.53.124 port 40020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 29 14:52:23 host2 sshd[2732591]: Disconnected from invalid user admin1234 128.199.157.145 port 39216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-29 14:54:43 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:57508: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.203.52
country_id: 6252001
description:
Nov 29 14:54:45 host2 sshd[2734521]: Disconnected from invalid user free 167.172.203.52 port 33024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:54:47 host2 sshd[2734525]: Disconnected from invalid user bitrix 85.133.253.204 port 42892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 14:54:59 host2 sshd[2734625]: Disconnected from invalid user zmarin 101.36.116.29 port 52320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-29 14:55:02 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:55224: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:56:02 host2 sshd[2735338]: Disconnected from invalid user ts3 85.133.253.204 port 36592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 29 14:55:37 host2 sshd[2735159]: Disconnected from invalid user ts3 128.199.157.145 port 57024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 29 14:55:40 host2 sshd[2735171]: Disconnected from invalid user john 209.141.53.124 port 40332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:57:19 host2 sshd[2736123]: Disconnected from invalid user zimbra 85.133.253.204 port 60050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.19
country_id: 6251999
description:
2025-11-29 14:57:29 dovecot_login authenticator failed for (ADMIN) [212.56.52.19]:50402: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:58:35 host2 sshd[2736937]: Disconnected from invalid user grid 85.133.253.204 port 42316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 29 14:59:29 host2 sshd[2737478]: Disconnected from invalid user kali 128.199.157.145 port 51774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 14:59:59 host2 sshd[2737741]: Disconnected from invalid user temp 101.36.116.29 port 56880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 29 15:01:04 host2 sshd[2738584]: Disconnected from invalid user qiyuesuo 209.141.53.124 port 36130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 15:01:07 host2 sshd[2738600]: Disconnected from invalid user admin123 101.36.116.29 port 35936 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 15:03:07 host2 sshd[2740011]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Nov 29 15:04:49 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.212, lip=66.85.158.91, session=<k64bdbhEnPnG6xjU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-29 15:05:48 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:46463: 535 Incorrect authentication data (set_id=marketing)


