# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.247
country_id: 6252001
description:
Nov 17 11:30:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.174.247, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1nk5D8RDFqAofK73>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.128.249
country_id: 6252001
description:
Nov 17 11:37:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.98.128.249, lip=66.85.158.92, session=<Jhs1K8RDKtQUYoD5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 11:43:34 host2 sshd[2322965]: Disconnected from invalid user user 2.57.121.25 port 25642 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 11:59:49 host2 sshd[2333477]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 17 12:02:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.161.174.170, lip=66.85.158.91, session=<3yChgcRDXLEzoa6q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.128.111
country_id: 6252001
description:
Nov 17 12:02:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.98.128.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CY0Pg8RD1JMUYoBv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Nov 17 12:04:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.12, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TNNfisRDrcOTuYQM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-17 12:08:59 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.112
country_id: 6252001
description:
2025-11-17 12:09:20 dovecot_login authenticator failed for ([209.23.72.112]) [209.23.72.112]:45192: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 12:10:24 host2 sshd[2340104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 17 12:14:03 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<3CBKrMRD4tDPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.231
country_id: 6252001
description:
Nov 17 12:14:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.231, lip=66.85.158.91, session=<YMN5rMRD9OfN0h/n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.147
country_id: 6252001
description:
Nov 17 12:20:36 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JsKxw8RDp8bDuEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.149
country_id: 6252001
description:
Nov 17 12:20:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.149, lip=66.85.158.91, TLS: Connection closed, session=<87NOxMRDwd/DuEyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.144
country_id: 6252001
description:
Nov 17 12:21:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.144, lip=66.85.158.91, TLS: Connection closed, session=<LbhRxcRDp+vDuEyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 12:28:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57495: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 17 12:34:14 host2 pure-ftpd[2364712]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 17 12:34:19 host2 pure-ftpd[2364782]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:38:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jfIiBMVD8rMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:39:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lvPjBsVDKMMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:40:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<LWcFCsVDlqEDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 12:41:41 host2 sshd[2372164]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:41:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0AuHDcVDZIwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:42:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YsmiEsVDAucDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:43:27 host2 sshd[2373928]: Disconnected from invalid user sanjay 165.22.63.108 port 45292 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:43:30 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</wKcFcVDCKkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:44:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<O0pnGMVDctMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:45:26 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<WKGIHMVDALsDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-17 12:46:54 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43164: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:47:49 host2 sshd[2378557]: Disconnected from invalid user upload 165.22.63.108 port 52960 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:49:14 host2 sshd[2379956]: Disconnected from invalid user haproxy 165.22.63.108 port 44234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:50:39 host2 sshd[2381388]: Disconnected from invalid user robinson 165.22.63.108 port 34524 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.69
country_id: 6252001
description:
Nov 17 12:51:32 host2 pure-ftpd[2382005]: (?@172.202.118.69) [INFO] New connection from 172.202.118.69


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:53:30 host2 sshd[2383043]: Disconnected from invalid user testuser 165.22.63.108 port 34190 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.35
country_id: 1605651
description:
Nov 17 12:53:59 host2 pure-ftpd[2383297]: (?@103.176.152.35) [INFO] New connection from 103.176.152.35


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 13:12:07 host2 sshd[2394530]: Disconnected from invalid user tristian 62.60.131.157 port 40653 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 161.35.105.100
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 161.35.105.100: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-17 13:22:29 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:57538: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2025-11-17 13:22:59 dovecot_login authenticator failed for (nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:50270: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.117.126
country_id: 6252001
description:
Nov 17 13:23:04 host2 pure-ftpd[2400393]: (?@40.124.117.126) [INFO] New connection from 40.124.117.126


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 13:23:33 host2 sshd[2400623]: Disconnected from invalid user user 2.57.121.25 port 47734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Nov 17 13:24:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, TLS, session=<OZgMqcVDXu2TuYRY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 17 13:25:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.92, session=<L83bq8VDIHFBMQFQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.124
country_id: 6252001
description:
Nov 17 13:26:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<V6xOrsVD8ZxAPpx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 17 13:26:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lMFur8VDzvRAPpx6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-17 13:30:07 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:48972: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-17 13:29:37 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br ([152.237.221.1]) [187.40.215.162]:40532: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.216.121.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.216.121.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.131.193.125
country_id: 6252001
description:
Nov 17 13:41:54 host2 pure-ftpd[2411691]: (?@45.131.193.125) [INFO] New connection from 45.131.193.125


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.158
country_id: 6252001
description:
Nov 17 13:44:39 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.19.158, lip=66.85.158.91, session=<gR5L8MVD3JUSYROe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.175
country_id: 6252001
description:
Nov 17 13:48:39 host2 sshd[2416440]: Invalid user cloudtourssrilan_travel from 124.198.132.175 port 59510


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:49:29 host2 sshd[2417068]: Disconnected from invalid user kafka 188.166.156.169 port 49812 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.212
country_id: 2635167
description:
Nov 17 13:50:20 host2 pure-ftpd[2418129]: (?@87.236.176.212) [INFO] New connection from 87.236.176.212


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:52:56 host2 sshd[2419629]: Disconnected from invalid user ftptest 188.166.156.169 port 38368 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 13:53:39 host2 sshd[2420068]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:55:12 host2 sshd[2421694]: Disconnected from invalid user joris 188.166.156.169 port 46708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:57:28 host2 sshd[2423146]: Disconnected from invalid user test1 188.166.156.169 port 42706 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.131.193.125
country_id: 6252001
description:
Nov 17 13:58:57 host2 pure-ftpd[2423939]: (?@45.131.193.125) [INFO] New connection from 45.131.193.125


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:59:37 host2 sshd[2424456]: Disconnected from invalid user es 188.166.156.169 port 42786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-17 14:02:04 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:64220: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.241.68
country_id: 2264397
description:
2025-11-17 14:02:53 dovecot_login authenticator failed for ([93.102.241.68]) [93.102.241.68]:59405: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-11-17 14:03:05 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:42514: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-17 14:02:15 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:19011: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-17 14:02:27 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:37081: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2025-11-17 14:06:47 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:37914: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-17 14:07:10 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:38092: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.152.146
country_id: 6252001
description:
Nov 17 14:16:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 26 secs): user=<>, rip=164.90.152.146, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hj/eYsZDyJukWpiS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.152.146
country_id: 6252001
description:
Nov 17 14:17:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.90.152.146, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<raqtZMZDPLakWpiS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:18:32 host2 sshd[2435625]: Disconnected from invalid user sanjay 35.199.95.142 port 58860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.247
country_id: 6252001
description:
Nov 17 14:20:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.247, lip=66.85.158.92, TLS, session=<nkYLb8ZDXvfG6xj3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov 17 14:22:16 host2 sshd[2437854]: Invalid user lankaherbalsolutions from 62.60.131.138 port 58386


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Nov 17 14:24:25 host2 pure-ftpd[2439057]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:24:25 host2 sshd[2439048]: Disconnected from invalid user l4d2 35.199.95.142 port 32914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:25:45 host2 sshd[2440078]: Disconnected from invalid user admin 35.199.95.142 port 33476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:27:09 host2 sshd[2440943]: Disconnected from invalid user josh 35.199.95.142 port 34042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 14:27:46 host2 sshd[2441277]: Disconnected from invalid user tristian 62.60.131.157 port 56071 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:31:32 host2 sshd[2443840]: Disconnected from invalid user mithun 35.199.95.142 port 35748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-11-17 14:35:06 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:57911: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.245.118
country_id: 617790
description:
2025-11-17 14:34:46 dovecot_login authenticator failed for (static.77.89.245.118.tmg.md) [77.89.245.118]:59548: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 14:35:23 host2 sshd[2446603]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:35:17 host2 sshd[2446521]: Disconnected from invalid user a 159.138.130.139 port 37786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 17 14:36:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7HoMqMZDsGdChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:36:53 host2 sshd[2447446]: Disconnected from invalid user online 159.138.130.139 port 48908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:38:21 host2 sshd[2448415]: Disconnected from invalid user jorge 159.138.130.139 port 33746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:39:45 host2 sshd[2449170]: Disconnected from invalid user composeruser 159.138.130.139 port 54860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.87.12.128
country_id: 1227603
description:
Nov 17 14:50:29 host2 dovecot[3661788]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=103.87.12.128, lip=66.85.158.91, TLS handshaking, session=<cC2528ZDkw9nVwyA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.87.12.128
country_id: 1227603
description:
Nov 17 14:53:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 149 secs): user=<>, rip=103.87.12.128, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<Cms26MZDJTtnVwyA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-17 14:57:51 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:39226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 15:03:00 host2 sshd[2464611]: Disconnected from invalid user user 2.57.121.25 port 33912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.43
country_id: 1880251
description:
Nov 17 15:06:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.99.35.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h7tEFsdDs9SLYyMr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.42
country_id: 1880251
description:
Nov 17 15:07:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=139.99.35.42, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<NgujF8dD26GLYyMq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.254.128
country_id: 1522867
description:
2025-11-17 15:31:21 dovecot_login authenticator failed for 2.135.254.128.dynamic.telecom.kz [2.135.254.128]:49475: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 15:31:51 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:50872: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 15:47:18 host2 sshd[2495819]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 17 15:52:51 host2 pure-ftpd[2499583]: (?@66.132.153.134) [INFO] New connection from 66.132.153.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.238.108.130
country_id: 1269750
description:
2025-11-17 15:58:24 dovecot_plain authenticator failed for ([89.116.164.85]) [103.238.108.130]:10731: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.0.217.215
country_id: 3508796
description:
2025-11-17 15:58:36 dovecot_plain authenticator failed for ([89.116.164.85]) [148.0.217.215]:36561: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.148
country_id: 6252001
description:
Nov 17 15:59:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.148, lip=66.85.158.91, TLS: Connection closed, session=<yQ/Y0MdDoqvHLZqU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.90.135.224
country_id: 6290252
description:
2025-11-17 15:58:11 dovecot_plain authenticator failed for ([89.116.164.85]) [185.90.135.224]:36740: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.41.119.155
country_id: 2077456
description:
2025-11-17 16:00:45 dovecot_plain authenticator failed for n1-41-119-155.mas21.nsw.optusnet.com.au ([89.116.164.85]) [1.41.119.155]:44574: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.10.195.240
country_id: 1210997
description:
2025-11-17 16:01:00 dovecot_plain authenticator failed for ([89.116.164.85]) [103.10.195.240]:45118: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.183.114.63
country_id: 3625428
description:
2025-11-17 16:01:12 dovecot_plain authenticator failed for ([89.116.164.85]) [38.183.114.63]:45196: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.23.230
country_id: 1282988
description:
2025-11-17 16:05:53 dovecot_plain authenticator failed for ([89.116.164.85]) [103.148.23.230]:64083: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.173.203.198
country_id: 3895114
description:
2025-11-17 16:06:06 dovecot_plain authenticator failed for ([89.116.164.85]) [181.173.203.198]:33078: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.173.203.198
country_id: 3895114
description:
2025-11-17 16:06:13 dovecot_login authenticator failed for ([89.116.164.85]) [181.173.203.198]:33078: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.5.36.78
country_id: 3469034
description:
2025-11-17 16:06:20 dovecot_plain authenticator failed for 191-5-36-78.sempre.tec.br ([89.116.164.85]) [191.5.36.78]:51653: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 16:07:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51524: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.245.25.71
country_id: 3469034
description:
2025-11-17 16:08:42 dovecot_plain authenticator failed for ([89.116.164.85]) [170.245.25.71]:64734: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.229.90.0
country_id: 1269750
description:
2025-11-17 16:08:48 dovecot_plain authenticator failed for ([89.116.164.85]) [43.229.90.0]:11585: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.155.130.155
country_id: 1269750
description:
2025-11-17 16:08:56 dovecot_plain authenticator failed for ([89.116.164.85]) [103.155.130.155]:41720: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 17 16:08:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<1Nfp8cdD/OdChJl8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.163.157.190
country_id: 630336
description:
2025-11-17 16:08:19 dovecot_plain authenticator failed for ([89.116.164.85]) [178.163.157.190]:6147: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.171.50
country_id: 289688
description:
2025-11-17 16:08:28 dovecot_plain authenticator failed for ([89.116.164.85]) [78.101.171.50]:45954: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.177.2.5
country_id: 290557
description:
2025-11-17 16:08:34 dovecot_plain authenticator failed for ([89.116.164.85]) [109.177.2.5]:56288: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.194.243
country_id: 1269750
description:
2025-11-17 16:10:48 dovecot_plain authenticator failed for ([89.116.164.85]) [103.167.194.243]:24030: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.219.120.82
country_id: 1269750
description:
2025-11-17 16:11:02 dovecot_plain authenticator failed for ([89.116.164.85]) [106.219.120.82]:19592: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.219.120.82
country_id: 1269750
description:
2025-11-17 16:11:09 dovecot_login authenticator failed for ([89.116.164.85]) [106.219.120.82]:19592: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.189.128.15
country_id: 6252001
description:
2025-11-17 16:11:14 dovecot_plain authenticator failed for ([89.116.164.85]) [23.189.128.15]:42752: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 17 16:14:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=<GVrHCMhDzL6nXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.126.128
country_id: 99237
description:
2025-11-17 16:19:23 dovecot_plain authenticator failed for ([89.116.164.85]) [212.237.126.128]:10586: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.130.190.135
country_id: 2077456
description:
2025-11-17 16:19:25 dovecot_plain authenticator failed for ([89.116.164.85]) [115.130.190.135]:54946: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.6.42.210
country_id: 6252001
description:
2025-11-17 16:19:35 dovecot_plain authenticator failed for 104-6-42-210.lightspeed.iplsin.sbcglobal.net ([89.116.164.85]) [104.6.42.210]:42363: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.209.3.246
country_id: 6252001
description:
2025-11-17 16:19:37 dovecot_plain authenticator failed for 69-209-3-246.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [69.209.3.246]:46072: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.220.40
country_id: 6252001
description:
2025-11-17 16:19:47 dovecot_plain authenticator failed for ([89.116.164.85]) [216.21.220.40]:45203: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.241.108.225
country_id: 6252001
description:
Nov 17 16:26:20 host2 sshd[2521178]: Invalid user cloudtourssrilan_travel from 151.241.108.225 port 55087


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.118.123.166
country_id: 6252001
description:
[2025-11-17 16:27:33 +0530] info [cpaneld] 75.118.123.166 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.188.32
country_id: 6252001
description:
[2025-11-17 16:27:42 +0530] info [cpaneld] 75.23.188.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.106.194
country_id: 6252001
description:
[2025-11-17 16:27:17 +0530] info [cpaneld] 67.84.106.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.127.54.132
country_id: 6252001
description:
[2025-11-17 16:27:23 +0530] info [cpaneld] 98.127.54.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.11.94.2
country_id: 6252001
description:
[2025-11-17 16:27:29 +0530] info [whostmgrd] 68.11.94.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.247.69.35
country_id: 6252001
description:
[2025-11-17 16:27:31 +0530] info [cpaneld] 76.247.69.35 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.241.108.225
country_id: 6252001
description:
Nov 17 16:27:48 host2 sshd[2521898]: Invalid user cloudtourssrilan_travel from 151.241.108.225 port 61390


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.75.146
country_id: 6252001
description:
[2025-11-17 16:27:15 +0530] info [cpaneld] 98.33.75.146 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 16:29:06 host2 sshd[2522608]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.86.215
country_id: 1269750
description:
2025-11-17 16:28:21 dovecot_plain authenticator failed for ([89.116.164.85]) [152.59.86.215]:46807: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.36.221.170
country_id: 102358
description:
2025-11-17 16:28:34 dovecot_plain authenticator failed for ([89.116.164.85]) [51.36.221.170]:4241: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.32.227
country_id: 99237
description:
2025-11-17 16:28:48 dovecot_plain authenticator failed for ([89.116.164.85]) [169.224.32.227]:31930: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 16:42:14 host2 sshd[2530206]: Disconnected from invalid user user 2.57.121.25 port 42095 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.52.150.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.52.150.178 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.80.19.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.80.19.23 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.108.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.129.108.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.179.87.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.179.87.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.84.224.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.84.224.209 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.249.137.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.249.137.210 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.40.49.140
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 38.40.49.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-17 17:20:55 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:34439: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-17 17:21:21 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60481: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 14.139.114.195
country_id: 1269750
description:
Nov 17 17:36:11 host2 pure-ftpd[2563367]: (?@14.139.114.195) [INFO] New connection from 14.139.114.195


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 17:36:55 host2 sshd[2563712]: Disconnected from invalid user user 2.57.121.25 port 37474 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 17:41:20 host2 sshd[2566100]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 17:42:37 host2 sshd[2566592]: Disconnected from invalid user frankie 62.60.131.157 port 24419 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-17 17:46:35 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:49319: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 17:46:49 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:57333: 535 Incorrect authentication data (set_id=hr)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.99.250.20
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 3.99.250.20: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.223.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.189.223.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.22.81.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.22.81.36 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.246.245.248
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.246.245.248 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.101.227.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.101.227.2 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.85.123.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.85.123.160 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.187.208.150
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.187.208.150 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 17 17:53:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<qIDsaslDfNtChJmL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.12.22.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.12.22.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.239.246.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.239.246.29 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.222.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.144.222.92 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.28.114.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.28.114.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.145.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 132.147.145.123 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.90.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.131.90.101 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.167.214.169
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.167.214.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 18:02:19 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:61715: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 18:19:16 host2 sshd[2592490]: Disconnected from invalid user user 2.57.121.25 port 9412 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 18:23:17 host2 sshd[2594897]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-17 18:23:48 dovecot_login authenticator failed for ([50.171.241.234]) [50.171.241.234]:47646: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-17 18:24:17 dovecot_login authenticator failed for ([181.129.31.42]) [181.129.31.42]:59716: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-17 18:25:52 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:37681: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-17 18:26:11 dovecot_login authenticator failed for ([182.78.79.134]) [182.78.79.134]:54836: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:02 +0530] info [cpaneld] 136.116.91.180 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:04 +0530] info [webmaild] 136.116.91.180 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user travel (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:07 +0530] info [whostmgrd] 136.116.91.180 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user root) has locked out IP 136.116.91.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:07 +0530] info [whostmgrd] 136.116.91.180 - cloudtou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user cloudtou) has locked out IP 136.116.91.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 17 18:33:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vfPw+MlD+mlChJl+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.129.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.129.143 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.126.131.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.126.131.176 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.90.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.202.90.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.57.18.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.57.18.111 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.105.180.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.105.180.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.170.212.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.170.212.225 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.180.110.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.180.110.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.227.224.196
country_id: 3469034
description:
Nov 17 18:46:37 host2 sshd[2609913]: Disconnected from invalid user samuel 168.227.224.196 port 31315 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:47:33 host2 sshd[2610334]: Disconnected from invalid user samuel 182.18.139.237 port 41246 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 17 18:49:00 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.4, lip=66.85.158.92, TLS, session=<Bf+8MMpDmrzCpGsE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov 17 18:52:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.40, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0+BPPcpDqdS594ko>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.177.178.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.177.178.20 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.160.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.160.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.205.183
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.33.205.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.213
country_id: 2635167
description:
Nov 17 18:52:30 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.213, lip=66.85.158.92, TLS, session=<CiVEPcpDmei594nV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:52:36 host2 sshd[2613250]: Disconnected from invalid user azure 182.18.139.237 port 33052 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.28
country_id: 690791
description:
2025-11-17 18:52:49 H=([45.144.212.28]) [45.144.212.28]:58493 F=<export@peak-ouyisports.com> rejected RCPT <info@ceylondigest.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.24.242.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.24.242.151 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.159.225.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.159.225.10 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 18:53:30 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:58529: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Nov 17 18:53:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<qfBGQcpDjY6594k8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Nov 17 18:53:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nEpLP8pDkcq594lI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.116.160.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.116.160.13 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.66
country_id: 2635167
description:
Nov 17 18:54:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.66, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<LmxCQ8pDSZNX7LBC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov 17 18:54:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.40, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<vwE+RcpDiYa594ko>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:54:56 host2 sshd[2615209]: Disconnected from invalid user samara 182.18.139.237 port 54818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.48
country_id: 2635167
description:
Nov 17 18:55:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.48, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7eQ2R8pD7cVX7LAw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.72
country_id: 2635167
description:
Nov 17 18:55:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.72, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+A40ScpDU6lX7LBI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.45
country_id: 2635167
description:
Nov 17 18:56:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.45, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<yG4vS8pDsbu594kt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.46
country_id: 2635167
description:
Nov 17 18:56:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.46, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<ecwoTcpDke1X7LAu>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.208.232
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.208.232 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Nov 17 18:57:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<REUkT8pD2+i594lI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.246.39.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.246.39.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.82.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 134.195.82.111 - simpleengineerin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.250.217.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.250.217.210 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.146.208.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.146.208.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.98.148.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 207.98.148.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.194.134.173
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.194.134.173 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.12.247.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.12.247.216 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:59:23 host2 sshd[2618043]: Disconnected from invalid user owner 182.18.139.237 port 41902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 17 19:03:12 host2 sshd[2620952]: Invalid user visionsolutionshospital from 154.219.110.64 port 56756


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 19:03:57 host2 sshd[2621368]: Disconnected from invalid user elasticsearch 182.18.139.237 port 57234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-17 19:05:44 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:38170: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-17 19:05:27 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:58534: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 19:07:34 host2 sshd[2623396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 19:09:18 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:64025: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-17 19:09:50 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:59928: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-17 19:10:28 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:38746: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.146.240.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.146.240.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.179.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.189.179.87 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.87.160.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.87.160.17 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.227.98.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.227.98.83 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.146.62.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.146.62.240 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.67.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.67.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.0.15.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.0.15.127 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.185.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.134.185.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.201.3.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.201.3.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.33.90.220
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.33.90.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.140.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.38.140.112 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.253.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 129.222.253.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.35.224.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.35.224.226 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.14.162.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.14.162.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.181.38
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.181.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.228.241.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.228.241.101 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.88.129.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.88.129.67 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.115.213.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.115.213.131 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.28.221
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.158.28.221 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.195.102.161
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.195.102.161 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 19:35:50 host2 sshd[2639605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.87.95.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.87.95.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.221.49.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.221.49.171 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.9.4.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.9.4.31 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.217.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.89.217.104 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.38.26.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.38.26.253 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.136.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.136.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.180.233
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.241.180.233 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.65
country_id: 1512440
description:
Nov 17 19:43:56 host2 sshd[2643982]: Disconnected from invalid user abdullah 194.107.115.65 port 33888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Nov 17 19:45:18 host2 sshd[2645366]: Disconnected from invalid user jack 194.107.115.65 port 61510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 19:55:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56923: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 19:55:37 host2 sshd[2651512]: Disconnected from invalid user user 2.57.121.25 port 22110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 19:55:19 host2 sshd[2651331]: Disconnected from invalid user gianni 62.60.131.157 port 25930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-17 19:58:03 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42125: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2025-11-17 19:58:17 dovecot_login authenticator failed for (sole2-029.alida.it) [130.255.96.29]:5356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-17 19:59:54 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:59209: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-11-17 19:59:39 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:49864: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.47.88
country_id: 6252001
description:
2025-11-17 20:07:35 dovecot_plain authenticator failed for ([10.143.41.218]) [143.244.47.88]:58288: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 20:07:45 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:60297: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.49
country_id: 3017382
description:
Nov 17 20:12:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.49, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cXTOW8tDSdpbxJgx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.73
country_id: 3017382
description:
Nov 17 20:12:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.73, lip=66.85.158.91, TLS: Connection closed, session=<FoT+W8tDJeZbxJhJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov 17 20:12:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZMpWWstDC6JbxJhN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.54
country_id: 3017382
description:
Nov 17 20:12:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.54, lip=66.85.158.91, TLS: Connection closed, session=<0UUCW8tD66NbxJg2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 20:18:03 host2 sshd[2664476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.200
country_id: 6252001
description:
Nov 17 20:30:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.200, lip=66.85.158.92, session=<+/PLnMtD91BAPpzI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 17 20:31:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<7o2SnctD2KVAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 17 20:31:13 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, session=<PcdHnstDzt1APpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov 17 20:31:49 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.92, session=<AA55oMtDwq5WNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 20:33:41 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:63033: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-17 20:49:22 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:60260: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 20:49:45 host2 sshd[2684836]: Disconnected from invalid user user 2.57.121.25 port 45904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-17 20:49:12 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:47640: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 17 21:05:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1nvTGMxDvrQzn+p2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 17 21:05:29 host2 pure-ftpd[2694976]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 21:08:09 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:56580: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.229
country_id: 6252001
description:
Nov 17 21:11:59 host2 pure-ftpd[2698931]: (?@205.210.31.229) [INFO] New connection from 205.210.31.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-11-17 21:13:52 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [103.26.53.164]:35262: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-11-17 21:13:14 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:58606: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-17 21:16:42 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:56730: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-17 21:16:59 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:57066: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 21:30:59 host2 sshd[2710027]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 21:31:38 host2 sshd[2710288]: Disconnected from invalid user user 2.57.121.25 port 47915 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 17 21:32:34 host2 pure-ftpd[2710955]: (?@198.235.24.101) [INFO] New connection from 198.235.24.101


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.138
country_id: 3194884
description:
Nov 17 21:37:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.229.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=</th3isxDkK2wfeWK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.49.36
country_id: 1668284
description:
Nov 17 21:37:14 host2 pure-ftpd[2714020]: (?@173.244.49.36) [INFO] New connection from 173.244.49.36


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.134
country_id: 1522867
description:
Nov 17 21:37:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.133.47.134, lip=66.85.158.91, TLS, session=<qXx+isxDkq0+hS+G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.247.34
country_id: 1562822
description:
Nov 17 21:37:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.239.247.34, lip=66.85.158.91, TLS handshaking: Connection closed, session=<E0+YisxDcqqt7/ci>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 223.252.16.146
country_id: 2077456
description:
Nov 17 21:37:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=223.252.16.146, lip=66.85.158.91, TLS, session=<LUWXisxDgqrf/BCS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.220.10
country_id: 3658394
description:
Nov 17 21:37:12 host2 pure-ftpd[2713998]: (?@173.239.220.10) [INFO] New connection from 173.239.220.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 17 21:53:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<CgXHwsxD2l24affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 17 21:53:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, TLS: Connection closed, session=<JQ+vw8xDfJ64affE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-11-17 21:54:36 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:38424: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-11-17 21:54:57 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:50751: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:03:57 host2 sshd[2743383]: Disconnecting authenticating user root 66.19.240.142 port 58044: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:03:57 host2 sshd[2743383]: error: maximum authentication attempts exceeded for root from 66.19.240.142 port 58044 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:04:14 host2 sshd[2743539]: Disconnecting authenticating user root 66.19.240.142 port 58152: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:04:14 host2 sshd[2743539]: error: maximum authentication attempts exceeded for root from 66.19.240.142 port 58152 ssh2 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 17 22:04:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.92, session=<qpUB7MxDkpCUcdOD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:04:39 host2 sshd[2743707]: Disconnecting invalid user admin 66.19.240.142 port 58294: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 22:05:40 host2 sshd[2744590]: Disconnected from invalid user keagan 62.60.131.157 port 52905 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-11-17 22:11:28 dovecot_login authenticator failed for ([182.72.87.193]) [182.74.12.86]:57238: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-17 22:12:07 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:40328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 22:13:07 host2 sshd[2748857]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.140
country_id: 6252001
description:
Nov 17 22:13:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.140, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<FvVuDc1DR8aTuYWM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.140
country_id: 6252001
description:
Nov 17 22:14:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=147.185.133.140, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ILKxDs1DvvaTuYWM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 17 22:20:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kvBPJc1DNnG4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 17 22:21:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<mVSlJ81DziS4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.140
country_id: 6252001
description:
Nov 17 22:21:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.140, lip=66.85.158.92, TLS, session=<JxBQKM1DvOmTuYWM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 17 22:31:36 host2 sshd[2764058]: Disconnected from invalid user freeswitch 51.158.152.220 port 41772 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 17 22:34:59 host2 sshd[2765886]: Disconnected from invalid user admin 51.158.152.220 port 33804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 17 22:37:12 host2 sshd[2767569]: Disconnected from invalid user zhangyx 51.158.152.220 port 53810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 17 22:39:26 host2 sshd[2768675]: Disconnected from invalid user premier 51.158.152.220 port 42218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.222
country_id: 1880251
description:
Nov 17 22:41:03 host2 sshd[2769862]: Disconnected from invalid user frappe 45.78.204.222 port 57838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2025-11-17 22:41:22 dovecot_login authenticator failed for ([117.205.2.9]) [117.205.2.9]:37035: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-17 22:42:27 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:48786: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-11-17 22:42:14 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:46425: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 22:43:56 host2 sshd[2771358]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-17 22:50:31 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:42034: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.154
country_id: 6252001
description:
Nov 17 22:51:34 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.154, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6hc5lM1D19aTuYSa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.154
country_id: 6252001
description:
Nov 17 22:52:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.132.154, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4aCTls1DZvuTuYSa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.22.212.32 - euroentertainmen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.154
country_id: 6252001
description:
Nov 17 22:58:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.154, lip=66.85.158.91, TLS, session=<yGxxrc1DvPyTuYSa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-17 23:02:55 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:39466: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.222
country_id: 1880251
description:
Nov 17 23:03:05 host2 sshd[2783203]: Disconnected from invalid user admin 45.78.204.222 port 59838 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 17 23:06:16 host2 pure-ftpd[2785794]: (?@216.218.206.67) [INFO] New connection from 216.218.206.67


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 23:06:30 host2 sshd[2785864]: Disconnected from invalid user user 2.57.121.25 port 52278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.222
country_id: 1880251
description:
Nov 17 23:07:55 host2 sshd[2786565]: Disconnected from invalid user mangesh 45.78.204.222 port 56010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Nov 17 23:09:26 host2 sshd[2787383]: Disconnected from invalid user test 43.154.195.142 port 40846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 17 23:10:12 host2 sshd[2788073]: Disconnected from invalid user dara 103.56.30.33 port 20928 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 186.67.150.242
country_id: 3895114
description:
Nov 17 23:10:43 host2 pure-ftpd[2788464]: (?@186.67.150.242) [INFO] New connection from 186.67.150.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Nov 17 23:11:19 host2 sshd[2788800]: Disconnected from invalid user devops 43.154.195.142 port 49716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 17 23:13:01 host2 sshd[2789533]: Disconnected from invalid user user 103.56.30.33 port 20780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Nov 17 23:14:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.167, lip=66.85.158.91, TLS: Connection closed, session=<2xqL5M1DfDNAPsWn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Nov 17 23:13:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jd9y481Ddi5BMQFs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.179
country_id: 6252001
description:
Nov 17 23:13:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.179, lip=66.85.158.91, session=<3D6v481D/Z1APsWz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Nov 17 23:14:16 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.167, lip=66.85.158.91, session=<UkJp5c1DrEtAPsWn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Nov 17 23:14:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS: Connection closed, session=<m/Cx5c1DUqpBMQFs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 17 23:15:42 host2 sshd[2791364]: Disconnected from invalid user ibrahim 103.56.30.33 port 31450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 23:17:39 host2 sshd[2792217]: Disconnected from invalid user keagan 62.60.131.157 port 46961 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.195.142
country_id: 1819730
description:
Nov 17 23:17:29 host2 sshd[2792193]: Disconnected from invalid user testmail 43.154.195.142 port 60320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-11-17 23:19:12 dovecot_login authenticator failed for ([38.226.107.72]) [38.226.107.70]:36229: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2025-11-17 23:19:37 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:44418: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 23:25:44 host2 sshd[2797495]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2025-11-17 23:26:48 dovecot_login authenticator failed for ([49.124.151.15]) [49.124.151.15]:50156: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-11-17 23:27:24 dovecot_login authenticator failed for ([125.19.173.202]) [152.52.236.2]:59788: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-17 23:33:01 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:34482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 23:33:10 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:37521: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.94
country_id: 6252001
description:
Nov 17 23:40:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<lM7SRM5DfPlAPpxe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.94
country_id: 6252001
description:
Nov 17 23:41:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AD3mRc5D/spAPpxe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 17 23:44:04 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, session=<YUT1T85DXLhHBobp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 23:44:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65293: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-17 23:53:41 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:56686: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-17 23:54:10 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:57322: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-17 23:54:23 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:48754: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Nov 17 23:59:42 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, session=<HyDjh85DEpjAm1rc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.80
country_id: 6252001
description:
Nov 18 00:16:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.80, lip=66.85.158.92, TLS, session=<c1KTws5DouLN0h9Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.120.21
country_id: 2921044
description:
Nov 18 00:19:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=159.65.120.21, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<bHzvz85D3fefQXgV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.3.129
country_id: 2921044
description:
Nov 18 00:20:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=159.89.3.129, lip=66.85.158.91, TLS handshaking: Connection closed, session=<76QK0s5DUh+fWQOB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 00:37:19 host2 sshd[2841325]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-11-18 00:39:18 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:34571: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.58.108.110
country_id: 1522867
description:
2025-11-18 00:40:14 dovecot_login authenticator failed for 95.58.108.110.dynamic.telecom.kz [95.58.108.110]:41352: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 18 00:40:48 host2 sshd[2844318]: Disconnected from invalid user user 2.57.121.25 port 28851 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.26.213
country_id: 1861060
description:
2025-11-18 00:43:30 dovecot_login authenticator failed for knet202126026213.kvision.ne.jp [202.126.26.213]:42678: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-18 00:43:12 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:44044: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-18 00:44:14 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:38638: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov 18 00:46:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS: Connection closed, session=<hIjyMM9D2D1ChJlz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov 18 00:47:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 1 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<+El4Mc9DKvpChJlz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Nov 18 00:53:42 host2 sshd[2853412]: Disconnected from invalid user proxyuser 103.172.204.219 port 35190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-18 00:56:26 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:55198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-18 00:56:47 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:37434: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 18 01:00:00 host2 pure-ftpd[2857776]: (?@148.113.213.23) [INFO] New connection from 148.113.213.23


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.219
country_id: 1643084
description:
Nov 18 00:59:10 host2 sshd[2857355]: Disconnected from invalid user agent 103.172.204.219 port 43064 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 18 01:00:07 host2 pure-ftpd[2858032]: (?@148.113.213.23) [INFO] New connection from 148.113.213.23


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 18 01:00:06 host2 pure-ftpd[2858027]: (?@148.113.213.23) [INFO] New connection from 148.113.213.23


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Nov 18 01:00:58 host2 sshd[2858529]: Disconnected from invalid user shree 103.172.204.219 port 36998 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.209
country_id: 2635167
description:
Nov 18 01:07:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.209, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<z3jTe89DTchX7LDR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.8
country_id: 2635167
description:
Nov 18 01:07:54 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.8, lip=66.85.158.91, TLS, session=<4FLKe89DT9BX7LAI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.204
country_id: 2635167
description:
Nov 18 01:08:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.204, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IeDOfc9Da6W594nM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.200
country_id: 2635167
description:
Nov 18 01:09:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.200, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0lrKf89Dz7m594nI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.195
country_id: 2635167
description:
Nov 18 01:09:35 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<87DKgc9DQem594nD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.184
country_id: 2635167
description:
Nov 18 01:10:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.184, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<YBDGg89DX89X7LC4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.252
country_id: 6252001
description:
Nov 18 01:10:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=45.79.207.252, lip=66.85.158.92, session=<svWKhc9D0J8tT8/8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.183
country_id: 2635167
description:
Nov 18 01:10:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.183, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<opO/hc9Dt5+594m3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.201
country_id: 2635167
description:
Nov 18 01:11:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.201, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<cOC8h89D+Ya594nJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.211
country_id: 2635167
description:
Nov 18 01:11:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.211, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wCO4ic9Dp9pX7LDT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov 18 01:12:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, session=<ovH+is9DGv/CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.188
country_id: 2635167
description:
Nov 18 01:12:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.188, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<gaKxi89DKeC594m8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.195
country_id: 2635167
description:
Nov 18 01:12:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.195, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<TOisjc9Ds5S594nD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-11-18 01:14:35 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:33401: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-11-18 01:14:47 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:47661: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 01:18:03 host2 sshd[2870065]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 01:18:06 host2 sshd[2870140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 01:19:08 host2 sshd[2871010]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 01:20:06 host2 sshd[2871761]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Nov 18 01:30:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.242.226.85, lip=66.85.158.91, session=<1ACuzc9DVJa58uJV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 18 01:35:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<it5X3c9DVGJChJmK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:35:23 host2 pure-ftpd[2881805]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:35:29 host2 pure-ftpd[2881857]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:36:06 host2 pure-ftpd[2882334]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:36:07 host2 pure-ftpd[2882338]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:37:07 host2 pure-ftpd[2883088]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:37:06 host2 pure-ftpd[2883081]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:38:06 host2 pure-ftpd[2883876]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:38:06 host2 pure-ftpd[2883881]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:39:06 host2 pure-ftpd[2884596]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 01:39:11 host2 pure-ftpd[2884650]: (?@47.76.240.198) [INFO] New connection from 47.76.240.198


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-18 01:45:34 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:54434: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-18 01:45:51 dovecot_login authenticator failed for ([201.15.149.254]) [201.15.149.254]:60024: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.255.98.76
country_id: 1668284
description:
2025-11-18 01:52:14 dovecot_login authenticator failed for (nbxjbvQk) [36.255.98.76]:60191: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.240
country_id: 6252001
description:
Nov 18 01:53:53 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cIY8INBDjsTN0h/w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 18 01:57:45 host2 sshd[2897707]: Disconnected from invalid user gm 172.245.45.194 port 37564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.138
country_id: 1733045
description:
2025-11-18 01:58:25 dovecot_login authenticator failed for ([49.124.142.138]) [49.124.142.138]:43466: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-18 01:59:27 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:36925: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-18 01:59:39 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:50630: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Nov 18 02:02:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.92, session=<QcdkQNBD9MC58uJV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 18 02:05:47 host2 sshd[2903621]: Disconnected from invalid user ftpuser 172.245.45.194 port 38354 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.255.69
country_id: 2921044
description:
Nov 18 02:09:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=207.154.255.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<c1/HVtBDnjDPmv9F>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 18 02:11:15 host2 sshd[2907412]: Disconnected from invalid user emo 172.245.45.194 port 39062 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-11-18 02:14:12 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:53066: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-11-18 02:15:00 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:50356: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 18 02:15:54 host2 sshd[2910757]: Disconnected from invalid user tony 172.245.45.194 port 39630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-18 02:17:44 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:41832: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-18 02:18:39 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:34902: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-18 02:25:29 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:54190: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Nov 18 02:27:19 host2 sshd[2918598]: Disconnected from invalid user mcuser 177.10.201.7 port 56908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Nov 18 02:28:27 host2 sshd[2919226]: Disconnected from invalid user media 103.159.132.217 port 34104 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 02:29:59 host2 sshd[2920222]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Nov 18 02:31:00 host2 sshd[2921262]: Disconnected from invalid user ts3 177.10.201.7 port 57266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 18 02:31:19 host2 sshd[2921562]: Disconnected from invalid user system 190.117.52.211 port 49020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.10.201.7
country_id: 3469034
description:
Nov 18 02:32:35 host2 sshd[2922296]: Disconnected from invalid user postgres 177.10.201.7 port 47694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Nov 18 02:33:33 host2 sshd[2922853]: Disconnected from invalid user pvx 103.159.132.217 port 44798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Nov 18 02:34:24 host2 sshd[2923344]: Disconnected from invalid user gbasedbt 177.10.201.7 port 38074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Nov 18 02:35:03 host2 sshd[2923847]: Disconnected from invalid user andrew 103.159.132.217 port 51234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 18 02:37:01 host2 sshd[2925117]: Disconnected from invalid user ivana 190.117.52.211 port 38472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.132.217
country_id: 1733045
description:
Nov 18 02:38:03 host2 sshd[2925678]: Disconnected from invalid user fabian 103.159.132.217 port 58708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 18 02:38:22 host2 sshd[2925854]: Disconnected from invalid user fabian 190.117.52.211 port 38920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Nov 18 02:39:32 host2 sshd[2926476]: Disconnected from invalid user caja2 103.159.132.217 port 41962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 18 02:39:46 host2 sshd[2926597]: Disconnected from invalid user media 190.117.52.211 port 57874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-18 02:44:26 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.241.234]:45144: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-18 02:44:48 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:50370: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-11-18 02:50:20 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:58165: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-11-18 02:50:34 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:51649: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.239.222
country_id: 3374766
description:
2025-11-18 02:52:25 dovecot_login authenticator failed for ([154.203.239.222]) [154.203.239.222]:46489: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-18 02:52:40 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:56712: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.146.15
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.55.146.15 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Nov 18 02:54:33 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.91, session=<zEoy+dBDrp+s7OTe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-11-18 02:56:06 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:52752: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-18 02:55:51 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:32826: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 03:11:28 host2 sshd[2949733]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-11-18 03:12:15 dovecot_login authenticator failed for ([82.193.122.91]) [82.193.122.91]:56605: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Nov 18 03:13:19 host2 sshd[2950903]: Disconnected from invalid user user1 99.92.204.98 port 39070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-18 03:12:36 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:55394: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 99.92.204.98
country_id: 6252001
description:
Nov 18 03:14:23 host2 sshd[2951486]: Disconnected from invalid user git 99.92.204.98 port 45484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 18 03:14:29 host2 sshd[2951544]: Disconnected from invalid user dspace 103.145.145.75 port 35292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Nov 18 03:16:27 host2 sshd[2952939]: Disconnected from invalid user postmaster 99.92.204.98 port 45824 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Nov 18 03:18:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<loV9TtFDwMLG6xil>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 18 03:18:28 host2 sshd[2954264]: Disconnected from invalid user abe 103.145.145.75 port 35546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Nov 18 03:18:41 host2 sshd[2954382]: Disconnected from invalid user helena 99.92.204.98 port 54496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-18 03:22:51 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:35809: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-18 03:23:18 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:36606: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.205.127.251
country_id: 6252001
description:
Nov 18 03:23:25 host2 pure-ftpd[2958018]: (?@34.205.127.251) [INFO] New connection from 34.205.127.251


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.136
country_id: 6252001
description:
Nov 18 03:26:57 host2 pure-ftpd[2960718]: (?@199.45.154.136) [INFO] New connection from 199.45.154.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 03:35:16 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51662: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-18 03:35:27 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:39084: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2025-11-18 03:35:51 dovecot_login authenticator failed for ([49.125.201.90]) [49.125.201.90]:46808: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.207
country_id: 6252001
description:
Nov 18 03:42:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PeTypdFDMsDN0h/P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-18 03:46:51 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:43511: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-18 03:47:05 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:50830: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-18 03:47:20 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:44044: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 03:47:50 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:59043: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.251
country_id: 6252001
description:
Nov 18 03:50:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PgrRwNFDR8XN0h/7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 18 04:04:24 host2 sshd[2994791]: Disconnected from invalid user user 2.57.121.25 port 50662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-11-18 04:06:25 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:50766: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.92
country_id: 2186224
description:
2025-11-18 04:06:49 dovecot_login authenticator failed for ([121.73.163.92]) [121.73.163.92]:35592: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-11-18 04:08:05 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:55778: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-11-18 04:07:42 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:34569: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.101.65.29
country_id: 1605651
description:
Nov 18 04:18:08 host2 sshd[3009243]: Disconnected from invalid user mario 165.101.65.29 port 46932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-18 04:18:23 dovecot_login authenticator failed for (adsl-181-129-31-42.une.net.co) [181.129.31.42]:39066: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-11-18 04:18:53 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:48148: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 04:22:36 host2 sshd[3013823]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Nov 18 04:29:06 host2 sshd[3022260]: Disconnected from invalid user mario 105.27.148.94 port 39934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.101.65.29
country_id: 1605651
description:
Nov 18 04:30:26 host2 sshd[3023320]: Disconnected from invalid user ec2-user 165.101.65.29 port 48176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 18 04:34:20 host2 sshd[3025778]: Disconnected from invalid user rene 172.190.89.127 port 59616 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Nov 18 04:34:47 host2 sshd[3026033]: Disconnected from invalid user ubuntu 105.27.148.94 port 52408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 18 04:36:47 host2 sshd[3027565]: Disconnected from invalid user foe 172.190.89.127 port 59674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.101.65.29
country_id: 1605651
description:
Nov 18 04:38:30 host2 sshd[3028519]: Disconnected from invalid user rundeck 165.101.65.29 port 48992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-18 04:41:15 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:45291: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 18 04:42:51 host2 sshd[3031496]: Disconnected from invalid user user 2.57.121.25 port 39851 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 18 04:47:19 host2 sshd[3035367]: Disconnected from invalid user user 172.190.89.127 port 40416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 04:47:31 host2 sshd[3035499]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 55262


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.160.19
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 163.5.160.19 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 18 04:48:39 host2 sshd[3036401]: Disconnected from invalid user usher 172.190.89.127 port 34056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 18 04:50:36 host2 sshd[3038090]: Disconnected from invalid user ubuntu 103.49.238.104 port 47036 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.27.42.6 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 18 04:53:46 host2 sshd[3040393]: Disconnected from invalid user user 103.49.238.104 port 46374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-11-18 04:56:38 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:49574: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-11-18 04:57:12 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:33952: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-11-18 04:57:18 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:49341: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.116.223
country_id: 99237
description:
Nov 18 04:58:19 host2 sshd[3044782]: Disconnected from invalid user devops 109.205.116.223 port 41500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-18 04:57:45 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:44365: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.205.116.223
country_id: 99237
description:
Nov 18 04:59:52 host2 sshd[3045996]: Disconnected from invalid user victor 109.205.116.223 port 45236 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 05:03:58 host2 sshd[3049256]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.116.223
country_id: 99237
description:
Nov 18 05:05:58 host2 sshd[3050776]: Disconnected from invalid user ubuntu 109.205.116.223 port 55108 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-18 05:08:56 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:57525: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-18 05:09:20 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:41092: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.102
country_id: 6252001
description:
Nov 18 05:10:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.102, lip=66.85.158.91, TLS: Connection closed, session=<B3eY3tJD9epb5qhm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.227
country_id: 6252001
description:
Nov 18 05:10:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.227, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Kzf33dJDwaBb5qjj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.97
country_id: 6252001
description:
Nov 18 05:10:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.97, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dMaI39JDg+Zb5qhh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.230
country_id: 6252001
description:
Nov 18 05:10:35 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.230, lip=66.85.158.91, TLS: Connection closed, session=<+TW339JDSahb5qjm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.26.41
country_id: 6252001
description:
Nov 18 05:24:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.26.41, lip=66.85.158.92, session=<oQqyENNDLKkUqxop>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 18 05:24:54 host2 sshd[3066269]: Disconnected from invalid user tuan 43.252.229.25 port 50632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 18 05:29:45 host2 sshd[3070166]: Disconnected from invalid user enrico 43.252.229.25 port 53868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 05:30:35 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:45491: 535 Incorrect authentication data (set_id=consultas@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-11-18 05:32:08 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:55034: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 18 05:32:26 host2 sshd[3072081]: Disconnected from invalid user admin 43.252.229.25 port 60222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-18 05:32:27 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:41320: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 18 05:33:40 host2 sshd[3072822]: Disconnected from invalid user pivpn 43.252.229.25 port 35168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 18 05:36:07 host2 sshd[3074990]: Disconnected from invalid user sanjay 43.252.229.25 port 41506 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.251
country_id: 6252001
description:
Nov 18 05:40:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.251, lip=66.85.158.91, session=<IJxNSdNDVNEUQGn7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.249.221.45
country_id: 6252001
description:
Nov 18 05:47:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.249.221.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</MloY9NDPK00+d0t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.234
country_id: 6252001
description:
Nov 18 05:55:35 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.234, lip=66.85.158.92, TLS, session=<Ez6ogNNDgOkofK3q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.194
country_id: 2635167
description:
Nov 18 06:00:52 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS, session=<lrqNk9NDOZxX7LDC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 4.227.178.208
country_id: 6252001
description:
Nov 18 06:05:33 host2 pure-ftpd[3095840]: (?@4.227.178.208) [INFO] New connection from 4.227.178.208


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.210.81.91
country_id: 6252001
description:
Nov 18 06:11:19 host2 pure-ftpd[3099955]: (?@172.210.81.91) [INFO] New connection from 172.210.81.91


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 06:15:23 host2 sshd[3102647]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-18 06:22:00 dovecot_login authenticator failed for ([125.20.249.43]) [128.185.215.38]:35328: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-18 06:22:37 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:40833: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.15
country_id: 2186224
description:
2025-11-18 06:27:12 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:54468: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.206
country_id: 1861060
description:
2025-11-18 06:27:51 dovecot_login authenticator failed for ([92.202.82.102]) [154.47.20.206]:24246: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 18 06:30:30 host2 sshd[3112714]: Disconnected from invalid user csgoserver 103.52.37.10 port 31604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 18 06:30:57 host2 sshd[3112935]: Disconnected from invalid user user 2.57.121.25 port 18656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 18 06:31:51 host2 sshd[3113628]: Disconnected from invalid user ubuntu 103.52.37.10 port 45575 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 18 06:34:26 host2 sshd[3114928]: Disconnected from invalid user els 103.52.37.10 port 29310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 18 06:35:43 host2 sshd[3115908]: Disconnected from invalid user ubuntu 103.52.37.10 port 54094 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.251.42
country_id: 2921044
description:
Nov 18 06:40:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=134.209.251.42, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FduSH9RDysyG0fsq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 18 06:40:39 host2 sshd[3118965]: Disconnected from invalid user iksi 103.52.37.10 port 42317 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-18 06:48:43 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:50420: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-18 06:48:31 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:3246: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 18 06:50:43 host2 sshd[3125975]: Disconnected from invalid user mostafa 45.78.207.77 port 54678 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 06:56:53 host2 sshd[3131385]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.212.161.88
country_id: 1819730
description:
Nov 18 07:00:39 host2 sshd[3133692]: Disconnected from invalid user bence 154.212.161.88 port 45304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 18 07:03:48 host2 sshd[3136347]: Disconnected from invalid user gitlab-runner 197.5.145.73 port 54168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 18 07:04:58 host2 sshd[3136932]: Disconnected from invalid user sachin 45.78.207.77 port 38712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.240
country_id: 6252001
description:
Nov 18 07:05:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.240, lip=66.85.158.91, TLS, session=<NoKTetRDivjG6xjw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 18 07:06:13 host2 sshd[3137833]: Disconnected from invalid user armen 197.5.145.73 port 54170 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.19
country_id: 6252001
description:
Nov 18 07:06:26 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iCQHftRDN8+TuYQT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 18 07:07:34 host2 sshd[3138837]: Disconnected from invalid user deploy 45.78.207.77 port 35214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 18 07:08:32 host2 sshd[3139360]: Disconnected from invalid user adi 197.5.145.73 port 54172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 18 07:09:38 host2 sshd[3139961]: Disconnected from invalid user user 197.5.145.73 port 54173 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-11-18 07:10:02 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:57074: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 18 07:10:44 host2 sshd[3140877]: Disconnected from invalid user va 197.5.145.73 port 54174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 18 07:10:14 host2 sshd[3140476]: Disconnected from invalid user sanjay 45.78.207.77 port 44952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 18 07:15:22 host2 sshd[3144759]: Disconnected from invalid user dspace 45.78.207.77 port 33990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-18 07:16:12 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:46056: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-18 07:16:37 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:36668: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 07:23:34 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57957: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:27:06 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<x27nx9RD4uIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-11-18 07:27:07 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:34468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-18 07:27:33 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:34000: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:29:17 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<UUq0z9RD4pMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Nov 18 07:30:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<njFk0tRDZA9KUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Nov 18 07:30:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zhqj09RDYOpKUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:30:55 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<UR2Q1dRD9JsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:31:43 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<DeZw2NRDeKMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:32:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<g85X3NRD0N4DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:32:55 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<pQW33NRDHqEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:33:23 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VJlm3tRD8oQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:34:40 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<ijMB49RDMKIDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:35:26 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<nR+55dRDMqMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:35:22 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<mex85dRDlOQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 18 07:37:10 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<zNfs69RDPqkDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.76.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.147.76.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Nov 18 07:39:13 host2 sshd[3159442]: Disconnected from invalid user myth 103.72.147.99 port 41194 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.9
country_id: 6252001
description:
Nov 18 07:42:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.9, lip=66.85.158.92, session=<AueZANVDru2TuYQJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.202
country_id: 2635167
description:
Nov 18 07:43:26 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.202, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<1FJaAtVDIMwjy9LK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.202
country_id: 2635167
description:
Nov 18 07:44:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.202, lip=66.85.158.92, TLS, session=<IZagBdVDcv4jy9LK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 18 07:45:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nmiyCdVDj//CpRCk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Nov 18 07:46:52 host2 sshd[3164654]: Disconnected from invalid user ftpdata 103.72.147.99 port 36416 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Nov 18 07:48:08 host2 sshd[3165439]: Disconnected from invalid user wyk 103.72.147.99 port 35492 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.202
country_id: 2635167
description:
Nov 18 07:50:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.202, lip=66.85.158.92, TLS, session=<L5L/GdVD1Pkjy9LK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-18 07:50:57 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([189.44.180.233]) [201.61.40.117]:35588: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-18 07:51:08 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:37750: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.202
country_id: 2635167
description:
Nov 18 07:50:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.202, lip=66.85.158.92, TLS, session=<RX0tG9VDPOUjy9LK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Nov 18 07:53:10 host2 sshd[3169146]: Disconnected from invalid user postgres 103.72.147.99 port 52614 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.172
country_id: 6252001
description:
Nov 18 07:59:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XApeOtVDPZDDuEys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.69
country_id: 6252001
description:
Nov 18 07:59:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.69, lip=66.85.158.92, TLS: Connection closed, session=<TrP6OtVDAaTDuExF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.175
country_id: 6252001
description:
Nov 18 08:06:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.175, lip=66.85.158.91, TLS, session=<ftuQVNVDHPLN0h+v>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 08:08:24 host2 sshd[3180181]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.216.150.69
country_id: 6252001
description:
2025-11-18 08:18:04 dovecot_login authenticator failed for 67-216-150-67-216-150-69.cpe.sparklight.net [67.216.150.69]:47177: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-18 08:22:55 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:56306: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-18 08:23:12 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:41560: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-18 08:24:05 dovecot_login authenticator failed for ([122.187.229.36]) [122.187.229.36]:47092: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-11-18 08:24:26 dovecot_login authenticator failed for (31-154-125-200.orange.net.il) [2.55.125.200]:52393: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.254.243.146
country_id: 1733045
description:
Nov 18 08:26:50 host2 pure-ftpd[3191237]: (?@47.254.243.146) [INFO] New connection from 47.254.243.146


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Nov 18 08:26:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MKOdm9VDzwnCpRCm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:29:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Aj3MqNVDXrQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:32:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Y+DmsdVDctMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:33:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<+jQ4tNVDaOcDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.69
country_id: 783754
description:
Nov 18 08:33:29 host2 sshd[3195304]: Disconnected from invalid user sd 79.106.102.69 port 33034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:34:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1jN6udVDPpEDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.69
country_id: 783754
description:
Nov 18 08:34:46 host2 sshd[3195934]: Disconnected from invalid user ssa 79.106.102.69 port 35362 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:35:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<+lxRvdVDJuEDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.102.69
country_id: 783754
description:
Nov 18 08:36:04 host2 sshd[3196860]: Disconnected from invalid user mihail 79.106.102.69 port 49400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:36:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8RjOwdVDqqgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:37:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<JHzzwtVDUrgDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.69
country_id: 783754
description:
Nov 18 08:38:23 host2 sshd[3198207]: Disconnected from invalid user ubuntu 79.106.102.69 port 45696 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:38:40 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<TCPgx9VDppUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:39:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<0QBGzNVDescDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:40:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<XjaCztVD7JgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:41:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YB+i0tVDrOoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 18 08:43:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<52eM19VDIKQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.112
country_id: 3017382
description:
Nov 18 08:45:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.112, lip=66.85.158.92, TLS: Connection closed, session=<T6gH39VDR+RbxJhw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 18 08:44:27 host2 sshd[3201849]: Disconnected from invalid user radio 172.185.24.228 port 54534 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.24
country_id: 3017382
description:
Nov 18 08:44:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wy5u3dVDnZdbxJgY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-11-18 08:44:50 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:54150: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.26
country_id: 3017382
description:
Nov 18 08:44:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.26, lip=66.85.158.92, TLS: Connection closed, session=<IAYS3tVDI7lbxJga>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.113
country_id: 3017382
description:
Nov 18 08:45:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.113, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jbbX3tVDz+tbxJhx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-11-18 08:45:16 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:57941: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 08:49:53 host2 sshd[3206979]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Nov 18 08:49:44 host2 sshd[3206897]: Disconnected from invalid user ted 150.5.169.176 port 41218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Nov 18 08:50:47 host2 sshd[3207701]: Disconnected from invalid user git 150.5.169.176 port 36848 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 18 08:50:09 host2 sshd[3207281]: Disconnected from invalid user ted 172.185.24.228 port 35834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-11-18 08:51:38 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:42498: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-11-18 08:52:16 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:36808: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 18 08:52:55 host2 sshd[3209064]: Disconnected from invalid user mostafa 172.185.24.228 port 46104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Nov 18 08:54:42 host2 sshd[3209637]: Disconnected from invalid user david 150.5.169.176 port 44432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 18 08:55:48 host2 sshd[3211818]: Disconnected from invalid user ubuntu 172.185.24.228 port 59924 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.176
country_id: 1819730
description:
Nov 18 08:56:41 host2 sshd[3212313]: Disconnected from invalid user erpnext 150.5.169.176 port 44478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-11-18 08:56:46 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:41614: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 18 08:57:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=<VGyuC9ZDMohChJlx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.117
country_id: 6252001
description:
Nov 18 09:05:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.117, lip=66.85.158.92, TLS, session=<S+CQKNZDOuSTuYR1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-18 09:06:55 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:39919: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-18 09:07:10 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 09:08:02 host2 sshd[3220497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.74.11.231
country_id: 6252001
description:
Nov 18 09:08:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=34.74.11.231, lip=66.85.158.91, session=<b1XtMNZDfIQiSgvn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.227.70.115
country_id: 6252001
description:
Nov 18 09:08:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=35.227.70.115, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+UwxMdZDmKUj40Zz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.227.70.115
country_id: 6252001
description:
Nov 18 09:08:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.227.70.115, lip=66.85.158.91, session=<UNmOMtZDKrsj40Zz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.227.70.115
country_id: 6252001
description:
Nov 18 09:08:34 host2 pure-ftpd[3220843]: (?@35.227.70.115) [INFO] New connection from 35.227.70.115


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.227.70.115
country_id: 6252001
description:
Nov 18 09:08:34 host2 pure-ftpd[3220862]: (?@35.227.70.115) [INFO] New connection from 35.227.70.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-18 09:08:17 dovecot_login authenticator failed for (pTUeIp) [178.16.54.32]:60913: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-18 09:09:28 dovecot_login authenticator failed for (nVGGjteTOd) [178.16.54.32]:65527: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-11-18 09:10:15 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:37460: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-18 09:10:14 dovecot_login authenticator failed for (AcqDqxl) [178.16.54.32]:62837: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 09:10:32 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:53942: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.10
country_id: 1605651
description:
Nov 18 09:15:28 host2 pure-ftpd[3225416]: (?@103.176.152.10) [INFO] New connection from 103.176.152.10


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.36
country_id: 2635167
description:
Nov 18 09:25:38 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.36, lip=66.85.158.91, TLS, session=<nnTTb9ZDF4y594kk>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.55
country_id: 6252001
description:
Nov 18 09:30:11 host2 pure-ftpd[3235725]: (?@198.235.24.55) [INFO] New connection from 198.235.24.55


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 18 09:31:16 host2 sshd[3236496]: Disconnected from invalid user admin 175.100.24.139 port 57668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 18 09:34:11 host2 sshd[3238383]: Disconnected from invalid user chen 175.100.24.139 port 35500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.60.245
country_id: 1269750
description:
2025-11-18 09:36:44 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.60.245]:16127: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 18 09:37:05 host2 sshd[3240679]: Disconnected from invalid user becky 175.100.24.139 port 41568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-11-18 09:37:08 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:40167: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 18 09:36:30 host2 sshd[3240294]: Disconnected from invalid user info1 46.24.47.94 port 38452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-18 09:38:08 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:32910: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-11-18 09:37:32 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:60484: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 18 09:40:31 host2 sshd[3242850]: Disconnected from invalid user sl 175.100.24.139 port 47644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-18 09:40:50 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:45112: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 18 09:41:03 host2 sshd[3243411]: Disconnected from invalid user njs 46.24.47.94 port 33112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-18 09:41:21 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:45564: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 18 09:44:58 host2 sshd[3246168]: Disconnected from invalid user pula 46.24.47.94 port 34286 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.135
country_id: 6252001
description:
Nov 18 09:47:42 host2 pure-ftpd[3248126]: (?@147.185.132.135) [INFO] New connection from 147.185.132.135


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:48:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<+QUZw9ZD6uEDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 18 09:49:50 host2 sshd[3249402]: Disconnected from invalid user trung 182.93.7.194 port 65188 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.46
country_id: 3017382
description:
Nov 18 09:50:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.46, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B406x9ZDy9RbxJgu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.45
country_id: 3017382
description:
Nov 18 09:50:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.45, lip=66.85.158.91, TLS: Connection closed, session=<5IfiyNZD97ZbxJgt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:50:15 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<6Kvjx9ZDCL4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.42
country_id: 3017382
description:
Nov 18 09:50:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.42, lip=66.85.158.91, TLS: Connection closed, session=<h9jax9ZDf7xbxJgq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.44
country_id: 3017382
description:
Nov 18 09:50:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.44, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<eYOyyNZD5cBbxJgs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:52:19 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<VKdFz9ZD5usDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:54:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<VXGB1tZDmpMDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:54:51 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<eKZO2NZDVOoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:55:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<LX9Q29ZD8sEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.249.67.65
country_id: 6252001
description:
Nov 18 09:55:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=44.249.67.65, lip=66.85.158.91, TLS: Connection closed, session=<bUCh29ZDUrMs+UNB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-11-18 09:56:09 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:42998: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:57:04 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<StRE4NZD3LYDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:56:14 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<jwlD3dZDroADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-18 09:56:36 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:45046: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 18 09:57:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<+i3d4NZDJN5ChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.36.48.250
country_id: 6252001
description:
Nov 18 09:57:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.36.48.250, lip=66.85.158.92, TLS: Connection closed, session=<UvdH4tZDELw0JDD6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 18 09:58:23 host2 sshd[3255711]: Disconnected from invalid user info1 182.93.7.194 port 58776 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 18 09:58:23 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<s2nx5NZD3p0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-11-18 10:02:55 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:54194: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 10:03:16 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:36912: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-18 10:03:33 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:51624: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.215.57
country_id: 1269750
description:
2025-11-18 10:03:42 dovecot_login authenticator failed for (abts-tn-static-057.215.165.122.airtelbroadband.in) [122.165.215.57]:45468: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 18 10:11:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.91, session=<JMYVEtdDLv7CpRCk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-11-18 10:25:09 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:46164: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-11-18 10:25:49 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:52423: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.69
country_id: 6252001
description:
Nov 18 10:27:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.69, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SdxATNdD+c2i2JZF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.69
country_id: 6252001
description:
Nov 18 10:28:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.69, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<rgj4T9dDiuOi2JZF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.69
country_id: 6252001
description:
Nov 18 10:34:56 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.69, lip=66.85.158.91, TLS, session=<42WvZ9dD4Pui2JZF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov 18 10:35:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<B0wLaNdD9//CpRCi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:50:13 host2 pure-ftpd[3292195]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:51:16 host2 pure-ftpd[3292766]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 18 10:51:49 host2 pure-ftpd[3293043]: (?@66.132.153.126) [INFO] New connection from 66.132.153.126


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:52:07 host2 pure-ftpd[3293396]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 10:52:15 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:37716: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-18 10:52:45 dovecot_login authenticator failed for ([182.79.31.107]) [152.52.199.126]:36016: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-18 10:53:05 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:59562: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:53:08 host2 pure-ftpd[3293972]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:54:09 host2 pure-ftpd[3294752]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.240
country_id: 3175395
description:
Nov 18 10:54:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=185.208.188.240, lip=66.85.158.91, TLS, session=<m+MCrddD/cS50Lzw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-11-18 10:54:58 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:55048: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.87
country_id: 953987
description:
Nov 18 10:54:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=102.64.33.87, lip=66.85.158.91, TLS, session=<8VkirtdDf95mQCFX>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:55:11 host2 pure-ftpd[3295755]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-11-18 10:55:17 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:36594: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:56:12 host2 pure-ftpd[3296416]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:57:13 host2 pure-ftpd[3297084]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:58:15 host2 pure-ftpd[3297688]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:59:16 host2 pure-ftpd[3298205]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:00:17 host2 pure-ftpd[3298939]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:01:18 host2 pure-ftpd[3299594]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:02:09 host2 pure-ftpd[3300139]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:03:10 host2 pure-ftpd[3301132]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:04:12 host2 pure-ftpd[3301672]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:05:15 host2 pure-ftpd[3302367]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:06:16 host2 pure-ftpd[3302910]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:07:07 host2 pure-ftpd[3303369]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:08:08 host2 pure-ftpd[3303870]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:09:10 host2 pure-ftpd[3304514]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:10:11 host2 pure-ftpd[3305150]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 11:10:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52779: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:11:12 host2 pure-ftpd[3305743]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:12:13 host2 pure-ftpd[3306461]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:13:15 host2 pure-ftpd[3306993]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:14:17 host2 pure-ftpd[3307584]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:15:08 host2 pure-ftpd[3308134]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:16:09 host2 pure-ftpd[3308604]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:17:10 host2 pure-ftpd[3309342]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:18:11 host2 pure-ftpd[3309882]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-18 11:18:39 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:53752: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-11-18 11:18:57 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:57494: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:19:13 host2 pure-ftpd[3310526]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:20:14 host2 pure-ftpd[3311216]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:21:16 host2 pure-ftpd[3311739]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Nov 18 11:22:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.137, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cM/FENhDPBZChJmJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:22:07 host2 pure-ftpd[3312182]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-18 11:22:12 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.227]:34623: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:23:08 host2 pure-ftpd[3312720]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:24:09 host2 pure-ftpd[3313243]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:25:11 host2 pure-ftpd[3314008]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:26:12 host2 pure-ftpd[3314658]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:27:13 host2 pure-ftpd[3315244]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:28:14 host2 pure-ftpd[3315821]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.184
country_id: 6252001
description:
Nov 18 11:28:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.162.184, lip=66.85.158.92, session=<uWaBJthD5q2Cg6K4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:29:15 host2 pure-ftpd[3316383]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:30:16 host2 pure-ftpd[3317277]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:31:17 host2 pure-ftpd[3317792]: (?@50.207.23.120) [INFO] New connection from 50.207.23.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-11-18 11:37:05 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:42518: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.117.131
country_id: 3144096
description:
2025-11-18 11:37:15 dovecot_login authenticator failed for ([46.212.117.131]) [46.212.117.131]:60349: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.60.199
country_id: 6252001
description:
Nov 18 11:42:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.60.199, lip=66.85.158.91, session=<QWDBWdhDUtEUozzH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 18 11:42:40 host2 sshd[3324599]: Disconnected from invalid user dns 81.192.46.35 port 34286 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 11:44:38 host2 sshd[3325756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 18 11:45:04 host2 sshd[3326690]: Disconnected from invalid user montse 81.192.46.35 port 39594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.153.69
country_id: 6252001
description:
Nov 18 11:45:59 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.232.153.69, lip=66.85.158.91, TLS, session=<EMXEZdhDnMGl6JlF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 18 11:46:29 host2 sshd[3327767]: Disconnected from invalid user bg 81.192.46.35 port 42240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 18 11:53:32 host2 sshd[3332494]: Disconnected from invalid user ali 81.192.46.35 port 55500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-11-18 11:54:02 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:39356: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-18 11:54:26 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:60260: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.213.4
country_id: 6252001
description:
Nov 18 11:58:53 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=66.175.213.4, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<3hDok9hDhKBCr9UE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.250.127
country_id: 1605651
description:
Nov 18 12:02:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=118.194.250.127, lip=66.85.158.92, session=<RhL1odhDojd2wvp/>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.194.250.127
country_id: 1605651
description:
Nov 18 12:02:50 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.194.250.127, lip=66.85.158.92, TLS, session=<leIIothDTjh2wvp/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.245
country_id: 6252001
description:
Nov 18 12:03:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=69.164.217.245, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<G7oBpthD0I9FpNn1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-18 12:04:06 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:37790: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-18 12:04:35 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:39912: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 18 12:09:39 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0GVfuthD8lPUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Nov 18 12:19:12 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.91, TLS, session=<gD6Q3NhDfres7OT1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Nov 18 12:24:29 host2 sshd[3355924]: Disconnected from invalid user scanner 103.67.78.56 port 60856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 18 12:24:35 host2 sshd[3356000]: Disconnected from invalid user dokku 196.204.240.61 port 57476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.56
country_id: 1643084
description:
Nov 18 12:26:06 host2 sshd[3357641]: Disconnected from invalid user greg 103.67.78.56 port 32966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 18 12:27:20 host2 sshd[3358608]: Disconnected from invalid user ubuntu 196.204.240.61 port 41030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Nov 18 12:27:37 host2 sshd[3358903]: Disconnected from invalid user dokku 103.67.78.56 port 53618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.41
country_id: 1643084
description:
Nov 18 12:28:56 host2 sshd[3359769]: Disconnected from invalid user admin 103.217.145.41 port 39814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.230.82.157
country_id: 2658434
description:
2025-11-18 12:28:19 dovecot_login authenticator failed for ([194.230.82.157]) [194.230.82.157]:35640: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-18 12:28:32 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:60755: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 18 12:28:34 host2 sshd[3359518]: Disconnected from invalid user nexus 196.204.240.61 port 44960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.56
country_id: 1643084
description:
Nov 18 12:30:28 host2 sshd[3361023]: Disconnected from invalid user sysadmin 103.67.78.56 port 35384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Nov 18 12:31:10 host2 sshd[3361436]: Disconnected from invalid user eb 196.204.240.61 port 48978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 18 12:32:26 host2 sshd[3362335]: Disconnected from invalid user demo 196.204.240.61 port 45438 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 18 12:33:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<N6mlD9lDII0jygmF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.220.15
country_id: 3658394
description:
Nov 18 12:39:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.239.220.15, lip=66.85.158.91, session=<sub2JdlDuqqt79wP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.220.5
country_id: 3658394
description:
Nov 18 12:39:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.239.220.5, lip=66.85.158.91, TLS, session=<B0H2JdlD6uGt79wF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.120.19
country_id: 798549
description:
Nov 18 12:39:43 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.90.120.19, lip=66.85.158.91, session=<hQn0JdlDyqpbWngT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.39
country_id: 357994
description:
Nov 18 12:39:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.214.122.39, lip=66.85.158.91, TLS handshaking: Connection closed, session=<os/2JdlD2uG81non>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.17
country_id: 1643084
description:
Nov 18 12:40:14 host2 sshd[3368235]: Disconnected from invalid user v 103.139.192.17 port 33852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-18 12:42:58 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:35484: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-18 12:43:16 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:59740: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.41
country_id: 1643084
description:
Nov 18 12:44:38 host2 sshd[3371350]: Disconnected from invalid user scanner 103.217.145.41 port 47164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 18 12:45:15 host2 sshd[3371930]: Disconnected from invalid user ftpuser 103.59.200.5 port 48774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 18 12:48:17 host2 sshd[3374421]: Disconnected from invalid user admin 103.59.200.5 port 47746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Nov 18 12:52:32 host2 sshd[3377583]: Disconnected from invalid user admin 103.139.192.17 port 35400 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-18 12:59:52 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:17190: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-18 12:59:22 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:60691: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:00:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<b4NccdlDmNUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:01:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dHseddlDUK0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:02:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Wvo4d9lDssIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7CfhedlDfswDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:05:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<jAq0gNlDgNoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:05:27 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<rQnygdlDtpoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:06:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<KOXqhtlD5L4DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.175
country_id: 6252001
description:
Nov 18 13:07:02 host2 sshd[3389438]: Invalid user cloudtourssrilan_travel from 124.198.132.175 port 62622


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:07:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RQ8qiNlD2rIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:08:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uWoCjNlDorEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 18 13:09:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<KLSDj9lDhL4DiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.124.152.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.124.152.210 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.212.91.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.212.91.194 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.144.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.44.144.143 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.82.156.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.82.156.178 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.67.103.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.67.103.15 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.206.129.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.206.129.48 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.21.155.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.21.155.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.57.5.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.57.5.216 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.189.68.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.189.68.21 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.134.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.155.134.234 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.154
country_id: 1880251
description:
Nov 18 13:19:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=15.235.189.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dTYZs9lDl7UP672a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.145
country_id: 1880251
description:
Nov 18 13:19:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=15.235.189.145, lip=66.85.158.92, TLS: Connection closed, session=<FyDgs9lDT4IP672R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.151
country_id: 1880251
description:
Nov 18 13:19:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=15.235.189.151, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HxigtNlDtc0P672X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.149
country_id: 1880251
description:
Nov 18 13:19:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.189.149, lip=66.85.158.92, TLS: Connection closed, session=<iqbQtNlD/ecP672V>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Nov 18 13:25:52 host2 sshd[3402237]: Disconnected from invalid user backup 152.32.250.188 port 57044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Nov 18 13:31:43 host2 sshd[3406022]: Disconnected from invalid user karol 186.248.197.77 port 42733 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-18 13:32:03 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:40431: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Nov 18 13:32:11 host2 sshd[3406325]: Disconnected from invalid user rich 139.59.188.13 port 51118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-18 13:32:24 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:59736: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-18 13:33:26 dovecot_login authenticator failed for (Zxj4Og) [185.196.8.151]:51348: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-18 13:33:50 dovecot_login authenticator failed for (j988Pi) [185.196.8.151]:58175: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-18 13:35:21 dovecot_login authenticator failed for (bKNQooxt9) [185.196.8.151]:51207: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Nov 18 13:35:21 host2 sshd[3408326]: Disconnected from invalid user last 186.248.197.77 port 16698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Nov 18 13:35:31 host2 sshd[3408519]: Disconnected from invalid user peter 139.59.188.13 port 48982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Nov 18 13:37:34 host2 sshd[3409683]: Disconnected from invalid user noah 139.59.188.13 port 47548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.248.197.77
country_id: 3469034
description:
Nov 18 13:36:47 host2 sshd[3409211]: Disconnected from invalid user wanghao 186.248.197.77 port 13010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Nov 18 13:38:22 host2 sshd[3410107]: Disconnected from invalid user validation 152.32.250.188 port 58344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Nov 18 13:39:32 host2 sshd[3410773]: Disconnected from invalid user mostafa 139.59.188.13 port 46106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Nov 18 13:40:57 host2 sshd[3411999]: Disconnected from invalid user peter 186.248.197.77 port 5197 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Nov 18 13:41:33 host2 sshd[3412418]: Disconnected from invalid user last 139.59.188.13 port 44666 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.33.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.33.24 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.24.130.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.24.130.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.108.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.132.108.14 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.72.116.229
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.72.116.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.46.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.34.46.27 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.246.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.246.121 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.148.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.149.148.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.190.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.166.190.36 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.222.210.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.222.210.210 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.246.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.128.246.121 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.221.221.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 150.221.221.40 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.40.175.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.40.175.184 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.31.220.193
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.31.220.193 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.74.88.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.74.88.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.167.100.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.167.100.70 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 13:54:12 host2 sshd[3422982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 13:54:54 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:29868: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.38.177
country_id: 2635167
description:
Nov 18 14:02:55 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=64.227.38.177, lip=66.85.158.91, TLS, session=<0s90T9pDItFA4yax>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 14:05:59 host2 sshd[3432025]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.69.12
country_id: 1269750
description:
2025-11-18 14:06:35 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:50980: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-18 14:06:49 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:52709: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 18 14:07:03 host2 pure-ftpd[3432680]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 18 14:07:07 host2 pure-ftpd[3432798]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.123
country_id: 6252001
description:
Nov 18 14:12:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.123, lip=66.85.158.92, TLS handshaking: Connection closed, session=<j72YcdpD0blb5qh7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.249
country_id: 6252001
description:
Nov 18 14:12:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.249, lip=66.85.158.92, TLS: Connection closed, session=<Fs7PctpDx7xb5qj5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.127
country_id: 6252001
description:
Nov 18 14:12:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.127, lip=66.85.158.92, TLS: Connection closed, session=<kdE6ctpD55lb5qh/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-18 14:18:06 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:36574: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-18 14:18:34 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:58832: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 18 14:20:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=134.209.173.54, lip=66.85.158.91, TLS, session=<AdUUjdpDWN+G0a02>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.149
country_id: 2635167
description:
Nov 18 14:20:19 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.149, lip=66.85.158.92, TLS, session=<wFawjdpDX6JX7LCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.172
country_id: 2635167
description:
Nov 18 14:20:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QKS+jdpDG4JX7LCs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.161
country_id: 2635167
description:
Nov 18 14:20:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.161, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fAq6j9pDT+RX7LCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.165
country_id: 2635167
description:
Nov 18 14:21:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.165, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<qaS1kdpD1elX7LCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.165
country_id: 2635167
description:
Nov 18 14:22:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.165, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<uSaxk9pDK6O594ml>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.177
country_id: 2635167
description:
Nov 18 14:22:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.177, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<G4WsldpDA+RX7LCx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Nov 18 14:21:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.121, lip=66.85.158.91, session=<YpxSktpDbPbG6xh5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.174
country_id: 2635167
description:
Nov 18 14:23:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.174, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ruull9pDGaW594mu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.157
country_id: 2635167
description:
Nov 18 14:24:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.157, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<6bKem9pD2elX7LCd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Nov 18 14:23:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.151, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yT6jmdpDq+q594mX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Nov 18 14:24:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.151, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<kwKYndpDi+y594mX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-18 14:25:15 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:47972: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.146
country_id: 2635167
description:
Nov 18 14:25:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.146, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<B1yTn9pDvaNX7LCS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-18 14:25:29 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:36108: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.156.29
country_id: 6252001
description:
Nov 18 14:29:26 host2 sshd[3446438]: Disconnected from invalid user mark 143.198.156.29 port 53216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-18 14:31:15 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:35747: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-11-18 14:31:28 dovecot_login authenticator failed for ([115.248.153.209]) [115.248.4.85]:51688: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.85.222.240
country_id: 6252001
description:
2025-11-18 14:31:36 dovecot_login authenticator failed for 64.85.222.240.reverse.socket.net [64.85.222.240]:32970: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-18 14:30:45 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:18015: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.156.29
country_id: 6252001
description:
Nov 18 14:32:37 host2 sshd[3448741]: Disconnected from invalid user oracle 143.198.156.29 port 50786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov 18 14:33:05 host2 sshd[3448977]: Disconnected from invalid user szy 154.91.170.52 port 49652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov 18 14:34:11 host2 sshd[3449505]: Disconnected from invalid user adam 154.91.170.52 port 49582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.156.29
country_id: 6252001
description:
Nov 18 14:33:46 host2 sshd[3449307]: Disconnected from invalid user acme 143.198.156.29 port 57794 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov 18 14:35:14 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, TLS, session=<juwNw9pDCHktT4DN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.56.49.28
country_id: 6251999
description:
Nov 18 14:36:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=212.56.49.28, lip=66.85.158.91, session=<w+FxxtpD8aDUODEc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov 18 14:37:18 host2 sshd[3451556]: Disconnected from invalid user pivpn 154.91.170.52 port 48472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.66.39
country_id: 2921044
description:
Nov 18 14:38:32 host2 sshd[3452515]: Disconnected from invalid user radix 172.86.66.39 port 34006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.156.29
country_id: 6252001
description:
Nov 18 14:39:21 host2 sshd[3452954]: Disconnected from invalid user webapp 143.198.156.29 port 58252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.66.39
country_id: 2921044
description:
Nov 18 14:40:46 host2 sshd[3454126]: Disconnected from invalid user santhosh 172.86.66.39 port 45730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Nov 18 14:40:38 host2 sshd[3454003]: Disconnected from invalid user demo 154.91.170.52 port 50076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov 18 14:41:37 host2 sshd[3454611]: Disconnected from invalid user dev 154.91.170.52 port 45596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.66.39
country_id: 2921044
description:
Nov 18 14:41:48 host2 sshd[3454735]: Disconnected from invalid user odoo 172.86.66.39 port 34450 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.126.237.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.126.237.32 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.94.243.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.94.243.29 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.156.29
country_id: 6252001
description:
Nov 18 14:43:52 host2 sshd[3455920]: Disconnected from invalid user gavin 143.198.156.29 port 43132 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.170.33
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.170.33 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.62.225.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.62.225.187 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.240.137.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.240.137.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.110.162.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.110.162.160 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.21.49.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.21.49.251 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-18 14:46:31 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:37616: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.86.66.39
country_id: 2921044
description:
Nov 18 14:46:06 host2 sshd[3457780]: Disconnected from invalid user deploy 172.86.66.39 port 44612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.55.99.226
country_id: 390903
description:
2025-11-18 14:46:53 dovecot_login authenticator failed for ppp005055099226.access.hol.gr [5.55.99.226]:35316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.66.39
country_id: 2921044
description:
Nov 18 14:48:17 host2 sshd[3458957]: Disconnected from invalid user user62 172.86.66.39 port 34120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-11-18 14:52:28 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:38090: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-18 14:52:47 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:34788: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-18 14:56:31 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:36704: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 14:58:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57749: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.252
country_id: 3017382
description:
Nov 18 15:02:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4WUBJdtD7elb51n8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.255
country_id: 3017382
description:
Nov 18 15:02:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.255, lip=66.85.158.92, TLS: Connection closed, session=<lImjJdtDdb1b51n/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.248
country_id: 3017382
description:
Nov 18 15:03:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.248, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TXGEJttDJ6xb51n4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.250
country_id: 3017382
description:
Nov 18 15:03:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.250, lip=66.85.158.92, TLS: Connection closed, session=<ts20JttD86lb51n6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.213
country_id: 6252001
description:
Nov 18 15:05:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.213, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cPVpL9tD19HN0h/V>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.96.75.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.96.75.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.37.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.145.37.194 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.204.202.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.204.202.2 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.66
country_id: 6252001
description:
Nov 18 15:06:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xQv6MttDutLN0h9C>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.206.224.5
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.206.224.5 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.66.219.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.66.219.103 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.242.46.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.242.46.172 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov 18 15:10:20 host2 sshd[3473592]: Disconnected from invalid user user 190.129.122.185 port 45910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2025-11-18 15:10:32 dovecot_login authenticator failed for ([49.125.201.68]) [49.125.201.68]:58158: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.150.76.96
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.150.76.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 18 15:11:16 host2 sshd[3474258]: Disconnected from invalid user worker 46.101.206.166 port 42992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-11-18 15:10:45 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:35941: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.161.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.172.161.98 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.120.150.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 97.120.150.124 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-18 15:10:59 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:51000: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.209.63.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.209.63.87 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-18 15:10:51 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:35999: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.61.70.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.61.70.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.46.200.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.46.200.195 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.120.65.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.120.65.1 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-18 15:11:50 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:41719: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 18 15:13:36 host2 sshd[3475736]: Disconnected from invalid user v 46.101.206.166 port 47636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.122.185
country_id: 3923057
description:
Nov 18 15:13:45 host2 sshd[3475803]: Disconnected from invalid user lucky 190.129.122.185 port 35982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 18 15:14:41 host2 sshd[3476305]: Disconnected from invalid user guest 46.101.206.166 port 33508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 18 15:16:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.92, session=<ez8hVttDUI6Ucd0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov 18 15:17:14 host2 sshd[3477953]: Disconnected from invalid user hadoop 190.129.122.185 port 38980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 18 15:18:09 host2 sshd[3478661]: Disconnected from invalid user services 46.101.206.166 port 36066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 18 15:18:22 host2 sshd[3478906]: Disconnected from invalid user partner 109.205.114.34 port 52242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.213.240
country_id: 6252001
description:
Nov 18 15:18:48 host2 sshd[3479152]: Disconnected from invalid user test 192.227.213.240 port 47612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Nov 18 15:19:03 host2 sshd[3479246]: Disconnected from invalid user liuyong 190.129.122.185 port 49512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 18 15:19:14 host2 sshd[3479404]: Disconnected from invalid user devops 46.101.206.166 port 38204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 18 15:19:26 host2 sshd[3479496]: Disconnected from invalid user jhernandez 45.78.237.21 port 39144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.213.240
country_id: 6252001
description:
Nov 18 15:20:00 host2 sshd[3479937]: Disconnected from invalid user user 192.227.213.240 port 53748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 18 15:22:44 host2 sshd[3481471]: Disconnected from invalid user sanjay 109.205.114.34 port 56294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 18 15:25:21 host2 sshd[3483175]: Disconnected from invalid user jhernandez 109.205.114.34 port 34608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 18 15:26:44 host2 sshd[3484106]: Disconnected from invalid user deploy 45.151.183.142 port 38588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-18 15:29:02 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:41346: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.205.114.34
country_id: 99237
description:
Nov 18 15:29:09 host2 sshd[3485568]: Disconnected from invalid user dockeruser 109.205.114.34 port 41154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-18 15:29:15 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:48379: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 18 15:31:45 host2 sshd[3487217]: Disconnected from invalid user crmadmin 109.205.114.34 port 54094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Nov 18 15:36:10 host2 sshd[3490005]: Disconnected from invalid user tmpuser 23.95.128.167 port 34690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.9
country_id: 798544
description:
Nov 18 15:37:24 host2 sshd[3490753]: Disconnected from invalid user admin 83.168.69.9 port 45626 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 18 15:39:13 host2 sshd[3491806]: Disconnected from invalid user stp 45.151.183.142 port 50022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.9
country_id: 798544
description:
Nov 18 15:39:49 host2 sshd[3492148]: Disconnected from invalid user sanjay 83.168.69.9 port 60094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Nov 18 15:40:54 host2 sshd[3493224]: Disconnected from invalid user free 23.95.128.167 port 50532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Nov 18 15:42:09 host2 sshd[3494056]: Disconnected from invalid user chris 23.95.128.167 port 44174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.9
country_id: 798544
description:
Nov 18 15:42:17 host2 sshd[3494150]: Disconnected from invalid user paper 83.168.69.9 port 39908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.9
country_id: 798544
description:
Nov 18 15:43:34 host2 sshd[3494943]: Disconnected from invalid user factorio 83.168.69.9 port 52836 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.128.167
country_id: 6252001
description:
Nov 18 15:43:21 host2 sshd[3494774]: Disconnected from invalid user ahmad 23.95.128.167 port 37008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Nov 18 15:44:31 host2 sshd[3495528]: Disconnected from invalid user teamspeak 23.95.128.167 port 38992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 18 15:45:06 host2 sshd[3496048]: Disconnected from invalid user nftp 45.78.237.21 port 38342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.9
country_id: 798544
description:
Nov 18 15:46:06 host2 sshd[3497460]: Disconnected from invalid user it 83.168.69.9 port 44704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 18 15:46:38 host2 sshd[3497765]: Disconnected from invalid user admin 152.32.201.226 port 42570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 15:49:19 host2 sshd[3499179]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 18 15:57:41 host2 sshd[3504572]: Disconnected from invalid user ubuntu 152.32.201.226 port 35300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-18 15:57:42 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:49761: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.40.145.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.40.145.103 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.62.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.226.62.234 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.151.223.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.151.223.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.81.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.41.81.100 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.23.236.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.23.236.154 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.64.40.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.64.40.24 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 16:01:05 host2 sshd[3506956]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 18 16:01:56 host2 sshd[3507286]: Disconnected from invalid user remote 45.78.237.21 port 37936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.135
country_id: 6252001
description:
Nov 18 16:05:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.135, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<o7m8BdxD3N3N0h+H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 18 16:05:39 host2 sshd[3510023]: Disconnected from invalid user runner 152.32.201.226 port 22250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 16:09:52 host2 sshd[3512383]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 59884


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 18 16:15:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<Q7dnKdxDeOyLonHU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.206.212.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.206.212.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.131.99.38
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.131.99.38 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.92.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.92.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.6.146.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.6.146.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.138.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.34.138.147 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.230.197
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.155.230.197 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.63.132.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.63.132.226 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 16:22:30 host2 sshd[3520778]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 59414


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.42.201
country_id: 6252001
description:
Nov 18 16:24:44 host2 sshd[3522009]: Disconnected from invalid user shalini 172.245.42.201 port 55396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-18 16:28:18 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:55338: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-18 16:28:35 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:36708: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-18 16:29:39 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:37482: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-18 16:29:46 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:57763: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.175.61.93
country_id: 3469034
description:
2025-11-18 16:29:52 dovecot_login authenticator failed for (179-175-61-93.user.vivozap.com.br) [179.175.61.93]:47676: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.42.201
country_id: 6252001
description:
Nov 18 16:31:01 host2 sshd[3525951]: Disconnected from invalid user admin 172.245.42.201 port 41208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 16:30:58 host2 sshd[3525927]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 61565


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:31:10 host2 sshd[3526066]: Disconnected from invalid user tony 103.159.199.42 port 39238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:32:27 host2 sshd[3526827]: Disconnected from invalid user sanjay 151.49.129.67 port 52182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.253
country_id: 6290252
description:
2025-11-18 16:33:24 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:59463: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.22
country_id: 1733045
description:
2025-11-18 16:33:44 dovecot_login authenticator failed for ([49.124.153.22]) [49.124.153.22]:58488: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.33.70.128
country_id: 6252001
description:
Nov 18 16:34:55 host2 pure-ftpd[3528093]: (?@45.33.70.128) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:36:00 host2 sshd[3528883]: Disconnected from invalid user newuser 103.159.199.42 port 53818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:37:21 host2 sshd[3529730]: Disconnected from invalid user admin 151.49.129.67 port 34558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:37:20 host2 sshd[3529720]: Disconnected from invalid user bill 103.159.199.42 port 48064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:40:50 host2 sshd[3531994]: Disconnected from invalid user newuser 151.49.129.67 port 51980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:41:24 host2 sshd[3532331]: Disconnected from invalid user dmdba 103.159.199.42 port 58936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:42:00 host2 sshd[3532710]: Disconnected from invalid user pendulum 151.49.129.67 port 58372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:42:42 host2 sshd[3533145]: Disconnected from invalid user mh 103.159.199.42 port 49154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:43:07 host2 sshd[3533412]: Disconnected from invalid user debian 151.49.129.67 port 58036 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 18 16:50:33 host2 pure-ftpd[3538666]: (?@165.227.134.101) [INFO] New connection from 165.227.134.101


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.222.165
country_id: 2921044
description:
Nov 18 16:50:32 host2 pure-ftpd[3538664]: (?@68.183.222.165) [INFO] New connection from 68.183.222.165


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 18 16:51:29 host2 pure-ftpd[3539286]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.144.110
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.144.110 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.27.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.181.27.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.140.169
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.50.140.169 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.182.106.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.182.106.139 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.2.164.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.2.164.39 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.145.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 132.147.145.60 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.10.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.51.10.36 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 18 16:54:26 host2 pure-ftpd[3541605]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 18 16:54:23 host2 pure-ftpd[3541537]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-18 17:00:19 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:48804: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-11-18 17:00:40 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:33332: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.160.19
country_id: 3017382
description:
[2025-11-18 17:03:06 +0530] info [cpaneld] 163.5.160.19 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 17:03:05 host2 sshd[3547673]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 60096


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.160.19
country_id: 3017382
description:
[2025-11-18 17:10:53 +0530] info [cpaneld] 163.5.160.19 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 17:10:53 host2 sshd[3552762]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 60908


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.82.220
country_id: 6252001
description:
Nov 18 17:11:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.80.82.220, lip=66.85.158.92, session=<sVcY8dxDVLQUUFLc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-18 17:13:43 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:47844: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-18 17:14:40 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:45440: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.160.125
country_id: 6252001
description:
[2025-11-18 17:15:20 +0530] info [cpaneld] 172.59.160.125 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.226.64.170
country_id: 6252001
description:
[2025-11-18 17:15:22 +0530] info [whostmgrd] 162.226.64.170 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.223.70.221
country_id: 6252001
description:
[2025-11-18 17:15:25 +0530] info [cpaneld] 97.223.70.221 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.61.7
country_id: 6252001
description:
[2025-11-18 17:15:10 +0530] info [cpaneld] 76.37.61.7 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.186.220.252
country_id: 6252001
description:
[2025-11-18 17:15:16 +0530] info [cpaneld] 98.186.220.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.167.138
country_id: 6252001
description:
[2025-11-18 17:15:41 +0530] info [cpaneld] 140.228.167.138 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.77.228.98
country_id: 6252001
description:
[2025-11-18 17:15:49 +0530] info [cpaneld] 173.77.228.98 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 18 17:17:40 host2 sshd[3557236]: Disconnected from invalid user jose 177.130.248.114 port 58296 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.7
country_id: 6252001
description:
Nov 18 17:17:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.173.7, lip=66.85.158.91, session=<YpSBBt1DwK0ofK0H>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.223.70.148
country_id: 6252001
description:
[2025-11-18 17:18:47 +0530] info [cpaneld] 172.223.70.148 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.235.152
country_id: 6252001
description:
[2025-11-18 17:18:53 +0530] info [cpaneld] 172.56.235.152 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.255.252.47
country_id: 6252001
description:
[2025-11-18 17:18:43 +0530] info [whostmgrd] 71.255.252.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.222.111.65
country_id: 6252001
description:
[2025-11-18 17:18:42 +0530] info [cpaneld] 47.222.111.65 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.178.112.68
country_id: 6252001
description:
[2025-11-18 17:18:50 +0530] info [cpaneld] 104.178.112.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.226.94.195
country_id: 6252001
description:
[2025-11-18 17:18:34 +0530] info [cpaneld] 108.226.94.195 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.45.49.215
country_id: 6252001
description:
[2025-11-18 17:18:36 +0530] info [cpaneld] 75.45.49.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 18 17:19:57 host2 sshd[3558522]: Disconnected from invalid user partner 152.32.189.21 port 53754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 18 17:19:16 host2 sshd[3558219]: Disconnected from invalid user jramirez 177.130.248.114 port 33812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 18 17:22:39 host2 sshd[3560307]: Disconnected from invalid user jramirez 152.32.189.21 port 38956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 18 17:22:07 host2 sshd[3560003]: Disconnected from invalid user ftpuser 177.130.248.114 port 41160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 18 17:23:56 host2 sshd[3561227]: Disconnected from invalid user jose 152.32.189.21 port 47114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-11-18 17:25:22 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:57074: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 17:26:23 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:34410: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.99.208
country_id: 6252001
description:
Nov 18 17:27:07 host2 sshd[3563438]: Disconnected from invalid user podcast 192.3.99.208 port 38460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-18 17:31:39 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:51876: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 18 17:38:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS: Connection closed, session=<vhalUt1DCOGUccE7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 18 17:39:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<umY9V91DvoqUccE7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-11-18 17:41:30 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:47088: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-18 17:42:45 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:50900: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-11-18 17:42:57 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:58570: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-18 17:42:20 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:50454: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 17:44:42 host2 sshd[3575750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 17:56:34 host2 sshd[3586886]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.190.163.191
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.190.163.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.111.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.33.111.79 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.19.34.205
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.19.34.205 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.123.178.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 163.123.178.210 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.95.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.8.95.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 17:57:07 host2 sshd[3587248]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 51897


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.130.74.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.130.74.182 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.56.209.231
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.56.209.231 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.40
country_id: 6252001
description:
Nov 18 18:01:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.40, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hCKgpd1DauqsynYo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Nov 18 18:05:08 host2 sshd[3594155]: Disconnected from invalid user ubuntu 181.104.58.194 port 46726 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.82.22
country_id: 6252001
description:
Nov 18 18:08:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.82.22, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3Ft2vt1DjJI0pVIW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.104.58.194
country_id: 3865483
description:
Nov 18 18:09:05 host2 sshd[3596980]: Disconnected from invalid user salon 181.104.58.194 port 52226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-18 18:09:58 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:34454: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-18 18:09:11 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:49488: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 18:10:25 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:56172: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-18 18:10:43 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:44403: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-18 18:11:32 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:38580: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-18 18:11:43 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:50838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 18 18:13:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AZoiz91D1K9ChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-11-18 18:13:47 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:32882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-11-18 18:14:10 dovecot_login authenticator failed for ([186.235.248.73]) [186.235.248.73]:33080: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 18:26:42 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:45892: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-11-18 18:26:30 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:51610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.149
country_id: 6252001
description:
Nov 18 18:31:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.149, lip=66.85.158.92, TLS: Connection closed, session=<URywEN5DarzHLZqV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-18 18:33:28 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:51068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-11-18 18:33:12 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:37246: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.35
country_id: 1880251
description:
Nov 18 18:35:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=139.99.35.35, lip=66.85.158.91, session=<a0GsHt5DW4+LYyMj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.42
country_id: 1880251
description:
Nov 18 18:35:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=139.99.35.42, lip=66.85.158.91, session=<kvxnH95DA5OLYyMq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 18:35:50 host2 sshd[3614207]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 59171


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.208.120
country_id: 2921044
description:
Nov 18 18:35:08 host2 pure-ftpd[3613912]: (?@46.101.208.120) [INFO] New connection from 46.101.208.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 18 18:35:09 host2 pure-ftpd[3613919]: (?@161.35.220.193) [INFO] New connection from 161.35.220.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-18 18:40:58 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:39555: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-11-18 18:41:12 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:50982: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.14.222
country_id: 6252001
description:
Nov 18 18:49:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.14.222, lip=66.85.158.92, session=<MDSmUd5D1LYUow7e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 18:50:38 host2 sshd[3623237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.116.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.116.55 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.222.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.222.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.248.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.248.194 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.114.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.114.77 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.32.144.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.32.144.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.209.41
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.209.41 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.135.110.47
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.135.110.47 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 18:54:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62999: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.156
country_id: 6252001
description:
Nov 18 18:56:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.162.156, lip=66.85.158.91, session=<o/91aN5DsuGCg6Kc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 18:57:12 host2 sshd[3628055]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.50.250.189
country_id: 3686110
description:
2025-11-18 19:00:34 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:35062: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-11-18 19:00:51 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:32568: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 19:00:27 host2 sshd[3629932]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 60218


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 19:03:38 host2 sshd[3632144]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 60855


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 18 19:06:29 host2 pure-ftpd[3634088]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 107.150.117.121
country_id: 2921044
description:
Nov 18 19:09:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=107.150.117.121, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cLVal95D5LlrlnV5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 107.150.117.121
country_id: 2921044
description:
Nov 18 19:09:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=107.150.117.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<07/3l95D8LlrlnV5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.17
country_id: 2635167
description:
Nov 18 19:09:36 host2 pure-ftpd[3635997]: (?@87.236.176.17) [INFO] New connection from 87.236.176.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.41.172
country_id: 390903
description:
2025-11-18 19:10:48 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:47548: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-18 19:10:59 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:58846: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-18 19:14:05 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:40700: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov 18 19:17:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, session=<wUd/tN5DiG9APpyi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.114
country_id: 6252001
description:
Nov 18 19:17:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.114, lip=66.85.158.91, session=<PlSutd5DeY5APsVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Nov 18 19:18:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, TLS: Connection closed, session=<H2xztt5DKHJAPsVr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 18 19:22:11 host2 sshd[3644015]: Disconnected from invalid user fabio 107.172.235.53 port 43014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 18 19:23:28 host2 sshd[3644968]: Disconnected from invalid user admin 107.172.235.53 port 40372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Nov 18 19:23:28 host2 sshd[3644946]: Disconnected from invalid user sonar 45.78.205.209 port 52452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Nov 18 19:23:34 host2 sshd[3645145]: Disconnected from invalid user deploy 103.187.147.214 port 45166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 18 19:24:35 host2 sshd[3645791]: Disconnected from invalid user user 107.172.235.53 port 14544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-11-18 19:25:59 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:59747: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.191.219
country_id: 1821275
description:
2025-11-18 19:26:19 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:50104: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Nov 18 19:26:46 host2 sshd[3647280]: Disconnected from invalid user admin 103.187.147.214 port 58226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.214
country_id: 1643084
description:
Nov 18 19:28:14 host2 sshd[3648596]: Disconnected from invalid user ubuntu 103.187.147.214 port 36816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Nov 18 19:28:48 host2 sshd[3648935]: Disconnected from invalid user mike 45.78.205.209 port 52112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.68
country_id: 2635167
description:
Nov 18 19:34:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<UoPp8N5Dtc0jy9JE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.68
country_id: 2635167
description:
Nov 18 19:35:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.68, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<i2+c9N5D3vojy9JE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 19:35:36 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:38914: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.201.11
country_id: 1168579
description:
2025-11-18 19:35:55 dovecot_login authenticator failed for (static.khi77.pie.net.pk) [221.120.201.11]:48933: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 107.150.117.121
country_id: 2921044
description:
Nov 18 19:37:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=107.150.117.121, lip=66.85.158.91, TLS, session=<FEjj+95DpNdrlnV5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 19:40:26 host2 sshd[3655715]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Nov 18 19:42:04 host2 sshd[3656696]: Disconnected from invalid user temp_user 45.78.205.209 port 36496 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.68
country_id: 2635167
description:
Nov 18 19:41:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.68, lip=66.85.158.91, TLS, session=<uQCnC99Dyvwjy9JE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.205.129.28
country_id: 3017382
description:
Nov 18 19:45:07 host2 sshd[3659098]: Disconnected from invalid user igor 154.205.129.28 port 55420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.205.129.28
country_id: 3017382
description:
Nov 18 19:46:14 host2 sshd[3659717]: Disconnected from invalid user zmarin 154.205.129.28 port 54170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.205.129.28
country_id: 3017382
description:
Nov 18 19:50:29 host2 sshd[3662133]: Disconnected from invalid user user8 154.205.129.28 port 47746 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 19:52:17 host2 sshd[3663157]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-18 19:53:14 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:51492: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 18 19:56:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, TLS, session=<8TmTQN9D+uWUcdZj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.240.125.200
country_id: 2635167
description:
2025-11-18 19:57:02 dovecot_login authenticator failed for host-89-240-125-200.as13285.net [89.240.125.200]:41136: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 19:56:18 host2 sshd[3666719]: Disconnected from invalid user ac 150.5.129.10 port 45036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-18 19:58:03 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:36851: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 19:59:40 host2 sshd[3668506]: Disconnected from invalid user tino 150.5.129.10 port 52286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 20:01:24 host2 sshd[3669701]: Disconnected from invalid user vpn 150.5.129.10 port 55930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 20:03:06 host2 sshd[3670950]: Disconnected from invalid user sammy 150.5.129.10 port 59540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-18 20:02:19 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:52500: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-11-18 20:02:34 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:58188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 20:05:11 host2 sshd[3672220]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 55090


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 20:05:54 host2 sshd[3672652]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58008


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 20:08:57 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:35686: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.186.182.85
country_id: 6252001
description:
Nov 18 20:08:57 host2 pure-ftpd[3674340]: (?@52.186.182.85) [INFO] New connection from 52.186.182.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-18 20:09:57 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:47420: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-18 20:17:48 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:20451: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-18 20:18:06 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:54478: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 18 20:19:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sW6CkN9DAIJChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-18 20:24:16 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:36355: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.206
country_id: 6252001
description:
Nov 18 20:26:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.206, lip=66.85.158.92, session=<n9bmqd9DdZHDuEzO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.152
country_id: 3996063
description:
Nov 18 20:27:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=138.122.97.152, lip=66.85.158.91, TLS, session=<EG63rN9Dx+SKemGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.207
country_id: 6252001
description:
Nov 18 20:26:24 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.207, lip=66.85.158.92, session=<5Snuqt9DscbDuEzP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.167
country_id: 6252001
description:
Nov 18 20:26:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.167, lip=66.85.158.92, session=<vjoeq99Dp83DuEyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.137.87
country_id: 2963597
description:
Nov 18 20:26:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=89.106.137.87, lip=66.85.158.91, TLS, session=<hCOsq99DGN1ZaolX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.140.93.55
country_id: 6252001
description:
Nov 18 20:30:33 host2 sshd[3688636]: Disconnected from invalid user pwserver 166.140.93.55 port 35390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.140.93.55
country_id: 6252001
description:
Nov 18 20:33:29 host2 sshd[3690061]: Disconnected from invalid user oracle 166.140.93.55 port 35166 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.182
country_id: 6252001
description:
Nov 18 20:37:42 host2 pure-ftpd[3692768]: (?@205.210.31.182) [INFO] New connection from 205.210.31.182


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.187.48.82
country_id: 130758
description:
Nov 18 20:45:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.187.48.82, lip=66.85.158.91, TLS, session=<qwV67d9DPee5uzBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.84
country_id: 6252001
description:
Nov 18 20:45:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.84, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vTnJ7t9Dy+FBMQFU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.161
country_id: 3175395
description:
Nov 18 20:45:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.161, lip=66.85.158.91, TLS, session=<mW2e7t9DLZ6rFuuh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 18 20:45:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0VH9799DoKFBMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-11-18 20:48:40 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:49382: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-18 20:48:56 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:40484: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-18 20:50:29 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:30414: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-18 20:51:16 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:39808: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.245
country_id: 6252001
description:
Nov 18 20:51:57 host2 pure-ftpd[3701975]: (?@198.235.24.245) [INFO] New connection from 198.235.24.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-18 20:52:06 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:38975: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-18 20:51:51 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:42136: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 20:53:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=165.154.164.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CUFpCuBDcOmlmqQY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 20:53:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=165.154.164.24, lip=66.85.158.91, TLS, session=<iDsmDOBDiK6lmqQY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-11-18 20:59:11 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:59870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-18 20:59:44 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:46716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 21:01:08 host2 sshd[3708120]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 59834


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-18 21:03:57 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:40533: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-18 21:04:28 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:53200: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-18 21:10:26 dovecot_plain authenticator failed for (dione) [65.20.174.63]:36072: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-18 21:29:45 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:60934: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-18 21:30:15 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:37176: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 18 21:34:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, TLS: Connection closed, session=<d0sIneBD2LyUcdZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.177.134
country_id: 3175395
description:
Nov 18 21:34:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.68.177.134, lip=66.85.158.91, TLS, session=<dzFyneBDmZ+5RLGG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.230
country_id: 2300660
description:
Nov 18 21:35:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.47.230, lip=66.85.158.91, TLS, session=<C9o7n+BD+80piy/m>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 21:36:46 host2 sshd[3732837]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.22
country_id: 3017382
description:
Nov 18 21:37:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.22, lip=66.85.158.92, session=<DrsEqeBDxaVbxJgW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.109
country_id: 3017382
description:
Nov 18 21:37:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.109, lip=66.85.158.92, session=<Io6nqeBDR+pbxJht>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.19
country_id: 3017382
description:
Nov 18 21:37:50 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.19, lip=66.85.158.92, session=<rA1iquBDy7JbxJgT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.111
country_id: 3017382
description:
Nov 18 21:37:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.111, lip=66.85.158.92, session=<IlSUquBDV4lbxJhv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 21:42:05 host2 sshd[3748912]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 52006


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.202
country_id: 6252001
description:
Nov 18 21:42:05 host2 pure-ftpd[3748971]: (?@64.62.156.202) [INFO] New connection from 64.62.156.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-18 21:46:51 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:41088: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-18 21:47:23 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:57598: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 21:48:38 host2 sshd[3753219]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 21:48:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=165.154.164.24, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</c+p0OBDVuGlmqQY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 18 21:48:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<m5A90uBDcny4aYtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.50.24
country_id: 6252001
description:
Nov 18 21:49:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.50.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wwhg0uBDAJctITIY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 21:49:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.164.24, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<diGA0+BDNJWlmqQY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 18 21:49:28 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<zHf40+BDrEi4aYtD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:01:06 host2 sshd[3761579]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 51334


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:03:18 host2 sshd[3763499]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 63502


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-11-18 22:03:40 dovecot_login authenticator failed for ([201.173.250.31]) [201.173.250.31]:34981: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-18 22:09:15 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:38710: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-18 22:09:23 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:56390: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.201
country_id: 3469034
description:
2025-11-18 22:09:25 dovecot_login authenticator failed for (ofluminense.static.gvt.net.br) [189.97.236.201]:60528: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-11-18 22:09:41 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:34070: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.223
country_id: 3469034
description:
Nov 18 22:10:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.89.136.223, lip=66.85.158.91, TLS, session=<DGh/H+FDNb6+WYjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.56.33
country_id: 1269750
description:
Nov 18 22:11:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.237.56.33, lip=66.85.158.91, TLS, session=<Tk+9IOFD0pJn7Tgh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.191.158.240
country_id: 1733045
description:
Nov 18 22:17:37 host2 sshd[3773863]: Disconnected from invalid user backend 42.191.158.240 port 57082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:17:44 host2 sshd[3773895]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 49644


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:19:34 host2 sshd[3775204]: Disconnected from invalid user admin 123.58.213.52 port 52530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:21:29 host2 sshd[3776861]: Disconnected from invalid user ftpuser 123.58.213.52 port 40540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:24:58 host2 sshd[3779363]: Disconnected from invalid user siva 152.32.135.139 port 36200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:25:25 host2 sshd[3779837]: Disconnected from invalid user alexey 123.58.213.52 port 57042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:26:17 host2 sshd[3780477]: Disconnected from invalid user abhi 152.32.135.139 port 36334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.191.158.240
country_id: 1733045
description:
Nov 18 22:27:47 host2 sshd[3781553]: Disconnected from invalid user pavan 42.191.158.240 port 47673 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2025-11-18 22:29:05 dovecot_login authenticator failed for (sole2-029.alida.it) [130.255.96.29]:5996: 535 Incorrect authentication data


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.191.158.240
country_id: 1733045
description:
Nov 18 22:29:18 host2 sshd[3782478]: Disconnected from invalid user jean 42.191.158.240 port 35140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-18 22:29:25 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:47336: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-18 22:29:52 dovecot_login authenticator failed for ([187.8.120.90]) [187.8.120.90]:47098: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:30:05 host2 sshd[3783149]: Disconnected from invalid user james 152.32.135.139 port 59992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:29:13 host2 sshd[3782443]: Disconnected from invalid user ubuntu 123.58.213.52 port 44658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:30:31 host2 sshd[3783469]: Disconnected from invalid user siva 123.58.213.52 port 57174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:32:37 host2 sshd[3784965]: Disconnected from invalid user victor 152.32.135.139 port 54016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-18 22:34:38 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:63158: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-18 22:35:18 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:62325: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 18 22:37:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<lnrAf+FDCrGLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:40:01 host2 sshd[3790438]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 63070


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 18 22:41:06 host2 pure-ftpd[3791636]: (?@167.94.146.59) [INFO] New connection from 167.94.146.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.72
country_id: 6252001
description:
Nov 18 22:42:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.72, lip=66.85.158.92, session=<hMP5keFDLUdAPpxI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov 18 22:42:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.92, TLS: Connection closed, session=<YXOqkuFDJr9APpxC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a02:c207:2280:7050::1
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a02:c207:2280:7050::1 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.127.242.250
country_id: 3017382
description:
2025-11-18 22:49:03 dovecot_login authenticator failed for laubervilliers-656-1-68-250.w82-127.abo.wanadoo.fr [82.127.242.250]:33606: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2025-11-18 22:49:24 dovecot_login authenticator failed for ([130.185.102.59]) [130.185.102.59]:50458: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-18 22:50:32 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:57748: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-18 22:52:51 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:50170: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-18 22:53:19 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:39438: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 23:00:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58968: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 23:06:39 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:55917: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-11-18 23:07:21 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:47626: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.42
country_id: 3175395
description:
Nov 18 23:07:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.171.42, lip=66.85.158.91, TLS, session=<O2eI6eFDT5G5D6sq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.226
country_id: 3469034
description:
Nov 18 23:07:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=190.89.137.226, lip=66.85.158.91, TLS, session=<o3em6uFDkIa+WYni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 18 23:08:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<CBKU7+FDv3tBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 18 23:09:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.152, lip=66.85.158.91, TLS: Connection closed, session=<Rm2K8eFDHHtBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.67.90
country_id: 2921044
description:
Nov 18 23:10:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.67.90, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<WCpE9OFDfTOlFkNa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.67.90
country_id: 2921044
description:
Nov 18 23:10:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=165.22.67.90, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<5oio9OFDdzWlFkNa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 18 23:10:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=161.35.220.193, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ivpf9uFDcumhI9zB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-18 23:13:39 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:59504: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.134
country_id: 690791
description:
Nov 18 23:15:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=194.44.140.134, lip=66.85.158.91, TLS, session=<UcQBB+JD59rCLIyG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.8
country_id: 2300660
description:
Nov 18 23:15:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=41.139.44.8, lip=66.85.158.91, TLS, session=<MKE8COJDIIgpiywI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:29:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RzbzOeJDicei2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:30:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<15QMPeJDoPCi2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:31:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<YeU7QOJDuvCi2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Nov 18 23:33:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<ewsbRuJDRtXE+2Qw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.170
country_id: 953987
description:
Nov 18 23:37:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.46.170, lip=66.85.158.91, TLS, session=<B89nU+JDPopmQC6q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.139.82.44
country_id: 798544
description:
Nov 18 23:37:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=79.139.82.44, lip=66.85.158.91, TLS, session=<O9mwVOJDya1Pi1Is>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:37:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS, session=<2uvRVuJDLvmi2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:38:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS, session=<3mPkWuJDrvui2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.107.56
country_id: 3469034
description:
Nov 18 23:43:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=187.120.107.56, lip=66.85.158.91, TLS, session=<MOGYauJDGJe7eGs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.122
country_id: 226074
description:
Nov 18 23:43:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=196.0.10.122, lip=66.85.158.91, TLS, session=<kyXha+JDsrzEAAp6>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 2.177.30.175
country_id: 130758
description:
Nov 18 23:46:23 host2 sshd[3832476]: Disconnecting authenticating user root 2.177.30.175 port 52783: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 2.177.30.175
country_id: 130758
description:
Nov 18 23:46:23 host2 sshd[3832476]: error: maximum authentication attempts exceeded for root from 2.177.30.175 port 52783 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 18 23:57:25 host2 sshd[3839613]: Disconnected from invalid user devuser 103.182.132.154 port 49848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 19 00:02:10 host2 sshd[3842945]: Disconnected from invalid user oracle 103.182.132.154 port 43942 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 19 00:02:53 host2 pure-ftpd[3843288]: (?@161.35.220.193) [INFO] New connection from 161.35.220.193


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 19 00:03:01 host2 pure-ftpd[3843391]: (?@161.35.220.193) [INFO] New connection from 161.35.220.193


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 19 00:03:40 host2 sshd[3844033]: Disconnected from invalid user pivpn 103.182.132.154 port 45974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 19 00:06:43 host2 sshd[3846009]: Disconnected from invalid user dashuai 103.182.132.154 port 51162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 19 00:07:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<x9KpwuJDaFFBMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 19 00:08:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS: Connection closed, session=<bfRHxOJD4HxBMQHA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-19 00:19:22 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:35074: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-19 00:19:38 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34735: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.25
country_id: 3865483
description:
Nov 19 00:20:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=181.191.223.25, lip=66.85.158.91, TLS, session=<5wIl7+JDIdi1v98Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.56
country_id: 798544
description:
Nov 19 00:20:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=91.231.122.56, lip=66.85.158.91, TLS, session=</LyH8OJDcMhb53o4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.32.25
country_id: 6252001
description:
2025-11-19 00:23:48 dovecot_plain authenticator failed for ([100.64.100.6]) [104.234.32.25]:62530: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.49
country_id: 2264397
description:
Nov 19 00:31:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.226.197.49, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7MCRFuNDtdC54sUx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.48
country_id: 2264397
description:
Nov 19 00:31:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.226.197.48, lip=66.85.158.92, TLS, session=<pMDHFuNDhbq54sUw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.49
country_id: 2264397
description:
Nov 19 00:31:08 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.226.197.49, lip=66.85.158.92, TLS, session=<T+QpFuNDHYC54sUx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.47
country_id: 2264397
description:
Nov 19 00:31:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.226.197.47, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+dlHFuNDhqC54sUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.50
country_id: 2264397
description:
Nov 19 00:31:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=185.226.197.50, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<9ylsFuNDc4254sUy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-19 00:34:40 dovecot_login authenticator failed for ([27.123.98.174]) [27.123.98.174]:45832: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-19 00:37:45 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:55943: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-19 00:38:24 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:49263: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 145.220.0.84
country_id: 2750405
description:
Nov 19 00:41:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share (no auth attempts in 0 secs): user=<>, rip=145.220.0.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share, session=<yQWPOuNDTIaR3ABU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-19 00:45:02 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:33199: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-19 00:45:28 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:47520: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-19 00:46:05 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:60154: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-19 00:46:23 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:28712: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.152
country_id: 3175395
description:
Nov 19 00:57:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.178.152, lip=66.85.158.91, TLS, session=<Uex2dONDOc/ZGrKY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.177
country_id: 3469034
description:
Nov 19 00:58:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=187.120.72.177, lip=66.85.158.91, TLS, session=<hyCideND5su7eEix>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.56
country_id: 3469034
description:
Nov 19 00:59:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=138.36.202.56, lip=66.85.158.91, TLS, session=<LSZseuNDhsSKJMo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.141
country_id: 1269750
description:
Nov 19 00:59:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.164.246.141, lip=66.85.158.91, TLS, session=<3x64e+NDvdVnpPaN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 01:00:39 host2 sshd[3881248]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.121.242.92
country_id: 6252001
description:
Nov 19 01:05:07 host2 pure-ftpd[3884120]: (?@34.121.242.92) [INFO] New connection from 34.121.242.92


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 01:12:18 host2 sshd[3888565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.231
country_id: 6252001
description:
Nov 19 01:12:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.231, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6pf6quNDecaTuYTn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.252.27.15
country_id: 1643084
description:
2025-11-19 01:24:58 dovecot_plain authenticator failed for ([31.57.166.48]) [180.252.27.15]:47152: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.75.2
country_id: 3469034
description:
2025-11-19 01:24:31 dovecot_plain authenticator failed for ([31.57.166.48]) [168.121.75.2]:15040: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.97.224.94
country_id: 3625428
description:
2025-11-19 01:24:42 dovecot_plain authenticator failed for ([31.57.166.48]) [190.97.224.94]:43006: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-19 01:25:40 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:55563: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Nov 19 01:25:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, TLS: Connection closed, session=<7Dqe2eND8OrLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-19 01:26:03 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:42930: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.108
country_id: 3469034
description:
Nov 19 01:26:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=179.189.201.108, lip=66.85.158.91, session=<bf2Y3ONDFoOzvcls>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.126
country_id: 3175395
description:
Nov 19 01:27:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.197.8.126, lip=66.85.158.91, TLS, session=<62Pd3eNDVou5xQh+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 19 01:27:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<8lcW3uNDImRChJmO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 19 01:27:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS, session=<qI1z3uNDNMZChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.27.24.117
country_id: 3489940
description:
2025-11-19 01:29:26 dovecot_plain authenticator failed for ([31.57.166.48]) [72.27.24.117]:46470: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.110.147.175
country_id: 3865483
description:
2025-11-19 01:29:38 dovecot_plain authenticator failed for ([31.57.166.48]) [181.110.147.175]:57820: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.180.186.170
country_id: 3469034
description:
2025-11-19 01:29:51 dovecot_plain authenticator failed for ([31.57.166.48]) [187.180.186.170]:22266: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 19 01:30:25 host2 sshd[3899839]: Disconnected from invalid user administrator 92.185.99.40 port 49240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.173
country_id: 6252001
description:
2025-11-19 01:30:31 dovecot_login authenticator failed for (lezzarotech.com) [89.187.173.173]:59900: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 19 01:32:41 host2 sshd[3901176]: Disconnected from invalid user vpn 92.185.99.40 port 43114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.38.201.125
country_id: 3469034
description:
2025-11-19 01:33:31 dovecot_plain authenticator failed for ([31.57.166.48]) [189.38.201.125]:37344: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.62.44.14
country_id: 6252001
description:
2025-11-19 01:33:42 dovecot_plain authenticator failed for 75-62-44-14.lightspeed.oshkwi.sbcglobal.net ([31.57.166.48]) [75.62.44.14]:36238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.232.147.135
country_id: 3865483
description:
2025-11-19 01:33:47 dovecot_plain authenticator failed for nat-45-232-147-135.dynamic.federacionnet.com.ar ([31.57.166.48]) [45.232.147.135]:54828: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.109.198
country_id: 3077311
description:
2025-11-19 01:33:54 dovecot_plain authenticator failed for ([31.57.166.48]) [185.15.109.198]:50526: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.225.52
country_id: 1210997
description:
2025-11-19 01:34:03 dovecot_plain authenticator failed for ([31.57.166.48]) [103.174.225.52]:51894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.225.52
country_id: 1210997
description:
2025-11-19 01:34:10 dovecot_login authenticator failed for ([31.57.166.48]) [103.174.225.52]:51894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.22.70.139
country_id: 2635167
description:
2025-11-19 01:34:15 dovecot_plain authenticator failed for seac-27-b2-v4wan-167637-cust650.vm25.cable.virginm.net ([31.57.166.48]) [86.22.70.139]:40520: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 19 01:36:05 host2 sshd[3903601]: Disconnected from invalid user srv 92.185.99.40 port 60616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2025-11-19 01:37:52 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:54574: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.96.232
country_id: 294640
description:
2025-11-19 01:38:12 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:60293: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Nov 19 01:38:52 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.92, session=<wBpkCORDZEes7OTl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-11-19 01:39:18 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:33752: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-19 01:39:30 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:47928: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.232
country_id: 6252001
description:
Nov 19 01:41:35 host2 pure-ftpd[3906857]: (?@205.210.31.232) [INFO] New connection from 205.210.31.232


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.42
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.42, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lXR5GORDbqC5tI0q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.43
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.43, lip=66.85.158.92, session=<2F92GORDs825tI0r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.43
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ENx+GORDocW5tI0r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.45
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.45, lip=66.85.158.92, TLS, session=<9gV9GORDmeC5tI0t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.11.89.175
country_id: 3923057
description:
2025-11-19 01:44:50 dovecot_login authenticator failed for host-190-11-89-175.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [190.11.89.175]:2712: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.7.22
country_id: 1880251
description:
2025-11-19 01:45:15 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:47846: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 01:52:55 host2 sshd[3914413]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.199
country_id: 798544
description:
Nov 19 01:53:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=89.107.155.199, lip=66.85.158.91, TLS, session=<wu/0OeRD74lZa5vH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.29.55
country_id: 3469034
description:
Nov 19 01:53:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=192.140.29.55, lip=66.85.158.91, TLS, session=<a5SCO+RD+LLAjB03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:53:59 host2 sshd[3915111]: Disconnected from invalid user eagle 103.13.206.142 port 42512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:56:09 host2 sshd[3917363]: Disconnected from invalid user elastic 103.13.206.142 port 55590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:57:51 host2 sshd[3918292]: Disconnected from invalid user teamspeak3 103.13.206.142 port 53570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 19 01:58:04 host2 sshd[3918347]: Disconnected from invalid user elastic 45.78.193.188 port 53510 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.147.33.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 12.147.33.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.188.112.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.188.112.212 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.186.161.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 70.186.161.101 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.52.85.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.52.85.39 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.198.3.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.198.3.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.213.217
country_id: 3865483
description:
2025-11-19 01:58:59 dovecot_plain authenticator failed for ([31.57.166.48]) [45.173.213.217]:48891: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.247.130.144
country_id: 6252001
description:
2025-11-19 01:59:10 dovecot_plain authenticator failed for c-73-247-130-144.hsd1.il.comcast.net ([31.57.166.48]) [73.247.130.144]:42800: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.75.223.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.75.223.214 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.170
country_id: 3658394
description:
2025-11-19 01:59:24 dovecot_plain authenticator failed for ([31.57.166.48]) [181.199.46.170]:40633: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:59:38 host2 sshd[3919321]: Disconnected from invalid user administrator 103.13.206.142 port 37780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.15
country_id: 6252001
description:
Nov 19 02:05:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.15, lip=66.85.158.92, session=<KgC+aORD5P+TuYQP>


