# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.62.8.90
country_id: 1643084
description:
Nov 10 08:50:22 host2 sshd[3731285]: Disconnected from invalid user ubuntu 202.62.8.90 port 54772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 08:59:09 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LyVpIjVDF8Gi2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 08:59:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2S8JJTVDLOKi2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 09:00:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<GPzyJjVDQuii2JZf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 09:03:08 host2 sshd[3748443]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.67
country_id: 298795
description:
Nov 10 09:06:30 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=95.0.171.67, lip=66.85.158.91, TLS, session=<iLKeOzVDM6VfAKtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 09:06:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS, session=<24liPTVD3Oui2JZf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.254
country_id: 953987
description:
Nov 10 09:06:52 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.34.254, lip=66.85.158.91, TLS, session=<aljLPDVDD7xmQCL+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 09:07:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS, session=<yco5QDVDbuKi2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 10 09:10:24 host2 sshd[3757368]: Disconnected from invalid user deploy 103.59.200.5 port 48312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 10 09:13:26 host2 sshd[3760961]: Disconnected from invalid user teamspeak 103.59.200.5 port 47112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-10 09:17:07 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:32856: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-10 09:16:33 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59216: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 10 09:16:40 host2 sshd[3766649]: Disconnected from invalid user nb 103.59.200.5 port 53562 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.204
country_id: 6252001
description:
Nov 10 09:21:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.204, lip=66.85.158.91, session=<s/khcTVDhOTN0h/M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-10 09:21:49 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:36187: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-10 09:21:56 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:52215: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-10 09:24:07 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:33422: 535 Incorrect authentication data (set_id=feedback@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.52
country_id: 1733045
description:
2025-11-10 09:24:21 dovecot_login authenticator failed for ([49.124.153.52]) [49.124.153.52]:36478: 535 Incorrect authentication data (set_id=feedback)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 09:34:51 host2 sshd[3790019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 09:36:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<6ZQ1pjVDnMo+PIOJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.175.19.145
country_id: 6252001
description:
Nov 10 09:39:55 host2 sshd[3796020]: Disconnected from invalid user db 172.175.19.145 port 60904 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.121.46.95
country_id: 6252001
description:
Nov 10 09:42:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.121.46.95, lip=66.85.158.92, session=<scxDvDVDfLAUeS5f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.175.19.145
country_id: 6252001
description:
Nov 10 09:44:10 host2 sshd[3802425]: Disconnected from invalid user fd 172.175.19.145 port 56852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.97.80
country_id: 1269750
description:
2025-11-10 09:49:22 dovecot_login authenticator failed for (183.82.97.80.actcorp.in) [183.82.97.80]:36840: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2025-11-10 09:49:36 dovecot_login authenticator failed for ([49.124.150.247]) [49.124.150.247]:53900: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.49
country_id: 6252001
description:
Nov 10 09:54:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.49, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JVJP6DVDpMKTuYQx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 10 09:55:19 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.60, lip=66.85.158.92, session=<ggY+6zVDgOSnXpI8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 09:58:17 host2 sshd[3821679]: Disconnected from invalid user user 2.57.121.25 port 51326 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.31
country_id: 6252001
description:
Nov 10 10:02:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=48.214.144.31, lip=66.85.158.91, session=<4cUpBjZDqtgw1pAf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.54
country_id: 2963597
description:
Nov 10 10:11:36 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=89.106.141.54, lip=66.85.158.91, TLS, session=<T4GEJDZD/t5Zao02>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.172
country_id: 3175395
description:
Nov 10 10:11:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.68.178.172, lip=66.85.158.91, TLS, session=<2q6UJTZDut25RLKs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.53
country_id: 1733045
description:
2025-11-10 10:14:41 dovecot_login authenticator failed for ([49.124.149.53]) [49.124.149.53]:47484: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-10 10:15:26 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:52552: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 10:19:11 host2 sshd[3850605]: Disconnected from invalid user kalyn 62.60.131.157 port 21726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 10:21:27 host2 sshd[3853453]: Disconnected from invalid user kalyn 62.60.131.157 port 9695 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-10 10:26:39 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:45504: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.207
country_id: 1733045
description:
2025-11-10 10:26:21 dovecot_login authenticator failed for ([49.124.152.207]) [49.124.152.207]:55232: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 10:28:53 host2 sshd[3862380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov 10 10:30:29 host2 pure-ftpd[3865500]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.125.242
country_id: 1733045
description:
Nov 10 10:38:10 host2 sshd[3873462]: Disconnected from invalid user david 103.61.125.242 port 46854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-11-10 10:38:43 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:56066: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.214
country_id: 1733045
description:
2025-11-10 10:39:21 dovecot_login authenticator failed for ([49.124.149.214]) [49.124.149.214]:32930: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.125.242
country_id: 1733045
description:
Nov 10 10:40:34 host2 sshd[3875984]: Disconnected from invalid user mostafa 103.61.125.242 port 57656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:40:52 host2 sshd[3876228]: Disconnected from invalid user oracle 129.154.42.120 port 50372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 10 10:41:05 host2 sshd[3876623]: Invalid user visionsolutionshospital from 154.219.110.64 port 45548


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.61.125.242
country_id: 1733045
description:
Nov 10 10:42:02 host2 sshd[3877662]: Disconnected from invalid user erpnext 103.61.125.242 port 58296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:43:41 host2 sshd[3879477]: Disconnected from invalid user radio 129.154.42.120 port 43066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Nov 10 10:46:35 host2 sshd[3884881]: Disconnected from invalid user david 36.89.28.139 port 58942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:47:43 host2 sshd[3886121]: Disconnected from invalid user david 129.154.42.120 port 10002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:50:27 host2 sshd[3889142]: Disconnected from invalid user myuser 129.154.42.120 port 35486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Nov 10 10:50:53 host2 sshd[3889586]: Disconnected from invalid user ict 36.89.28.139 port 59058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 10 10:54:26 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, session=<YHGnvjZDxIQDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-10 10:59:03 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36587: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-10 10:59:22 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:15445: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 11:02:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60375: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-10 11:05:57 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:52197: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-10 11:06:46 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:50950: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 10 11:08:02 host2 dovecot[1509044]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<hMxH7zZDQpFHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 10 11:08:03 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<ieFa7zZDVJRHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-10 11:07:19 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:58116: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Nov 10 11:18:26 host2 sshd[3927520]: Disconnected from invalid user admin 202.51.214.99 port 50266 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-10 11:20:59 H=([87.120.36.32]) [87.120.36.32]:52212 F=<info@wikipedia.org> rejected RCPT <mikek@gibsontruckworld.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.219
country_id: 6252001
description:
Nov 10 11:22:39 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.219, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<G4eSIzdDvNOTuYXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.219
country_id: 6252001
description:
Nov 10 11:23:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.219, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<1CcbJzdDlumTuYXb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.27.21
country_id: 3017382
description:
[2025-11-10 11:25:53 +0530] info [cpaneld] 173.249.27.21 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.120
country_id: 3175395
description:
Nov 10 11:27:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.120, lip=66.85.158.91, TLS, session=<t4DWMjdDcZq5D6t4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.99
country_id: 1643084
description:
Nov 10 11:26:34 host2 sshd[3937122]: Disconnected from invalid user steam 202.51.214.99 port 42232 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.58
country_id: 1269750
description:
Nov 10 11:26:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.30.83.58, lip=66.85.158.91, TLS, session=<xlSYMTdDApNnHlM6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-11-10 11:27:49 dovecot_login authenticator failed for ([50.79.249.83]) [50.79.249.83]:58823: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.219
country_id: 6252001
description:
Nov 10 11:30:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.219, lip=66.85.158.92, TLS, session=<k6dlQDdD5PGTuYXb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.7
country_id: 1733045
description:
2025-11-10 11:31:01 dovecot_login authenticator failed for ([49.124.153.7]) [49.124.153.7]:40078: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-10 11:31:18 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:34764: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.198.156
country_id: 1227603
description:
[2025-11-10 11:37:31 +0530] info [cpaneld] 112.134.198.156 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 11:37:45 host2 sshd[3949937]: Disconnected from invalid user user 2.57.121.25 port 30239 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 10 11:39:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<RIC9XjdD3roDU5En>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.198.156
country_id: 1227603
description:
[2025-11-10 11:39:27 +0530] info [cpaneld] 112.134.198.156 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.234
country_id: 6252001
description:
Nov 10 11:56:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.234, lip=66.85.158.91, session=<cEJ1nDdDtIRHBobq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.250.142.129
country_id: 1733045
description:
Nov 10 11:58:56 host2 pure-ftpd[3974337]: (?@47.250.142.129) [INFO] New connection from 47.250.142.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov 10 12:01:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.43.33.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NWFkrTdDZdstKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov 10 12:01:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.43.33.210, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NAb8rjdD0dEtKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.47
country_id: 6252001
description:
Nov 10 12:01:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.47, lip=66.85.158.92, TLS, session=<U1C5rzdDJvzG6xgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-10 12:01:57 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:53558: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.75
country_id: 2750405
description:
Nov 10 12:02:20 host2 pure-ftpd[3978361]: (?@196.251.87.75) [INFO] New connection from 196.251.87.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-10 12:01:25 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:50405: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.189
country_id: 6252001
description:
Nov 10 12:04:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=173.255.221.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jkRWujdDk7Ot/929>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 12:04:59 host2 sshd[3981384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 10 12:10:01 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<i+DzzDdDENuLonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 10 12:10:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pifmzzdD9uXUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-10 12:13:43 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:47737: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 12:13:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ZiCo2jdDVrU+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-10 12:14:25 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:51727: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 10 12:17:46 host2 pure-ftpd[3996601]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.216
country_id: 1733045
description:
2025-11-10 12:19:26 dovecot_login authenticator failed for ([49.124.152.216]) [49.124.152.216]:34890: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-10 12:19:34 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:49932: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.155
country_id: 953987
description:
Nov 10 12:23:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.129.54.155, lip=66.85.158.91, TLS, session=<wKs4/TdDeO1mgTab>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.84.1.105
country_id: 3469034
description:
Nov 10 12:24:09 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=170.84.1.105, lip=66.85.158.91, TLS, session=<arp0/jdDnb+qVAFp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.232.238
country_id: 2921044
description:
Nov 10 12:24:43 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=209.38.232.238, lip=66.85.158.91, session=<OVeRAThDHOTRJuju>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:30:14 host2 sshd[4011066]: Disconnected from invalid user joao 9.223.176.221 port 52232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.137
country_id: 1880251
description:
Nov 10 12:31:17 host2 sshd[4012278]: Disconnected from invalid user es_user 101.47.140.137 port 56024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:33:21 host2 sshd[4014287]: Disconnected from invalid user es_user 103.67.78.187 port 41898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:34:43 host2 sshd[4015567]: Disconnected from invalid user ars 103.67.78.187 port 53120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.115.88
country_id: 6252001
description:
[2025-11-10 12:37:07 +0530] info [cpaneld] 69.181.115.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.136.45.170
country_id: 6252001
description:
[2025-11-10 12:37:16 +0530] info [cpaneld] 169.136.45.170 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.8.137
country_id: 6252001
description:
[2025-11-10 12:37:00 +0530] info [cpaneld] 104.203.8.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.45.69.66
country_id: 6252001
description:
[2025-11-10 12:37:29 +0530] info [whostmgrd] 73.45.69.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.56.106
country_id: 6252001
description:
[2025-11-10 12:37:34 +0530] info [cpaneld] 174.182.56.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.31.201.171
country_id: 6252001
description:
[2025-11-10 12:37:41 +0530] info [cpaneld] 65.31.201.171 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.8.238.148
country_id: 6252001
description:
[2025-11-10 12:37:50 +0530] info [cpaneld] 204.8.238.148 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-10 12:37:58 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:45506: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-10 12:37:48 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:6314: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:38:48 host2 sshd[4020666]: Disconnected from invalid user ken 103.67.78.187 port 38336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:39:45 host2 sshd[4021187]: Disconnected from invalid user localhost 9.223.176.221 port 47602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.208.184.2
country_id: 149590
description:
Nov 10 12:42:43 host2 sshd[4022705]: Disconnected from invalid user t 102.208.184.2 port 51732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:46:57 host2 sshd[4025810]: Disconnected from invalid user support 9.223.176.221 port 55076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-10 12:47:05 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:52773: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:47:19 host2 sshd[4026386]: Disconnected from invalid user k8s 103.67.78.187 port 58838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-10 12:46:40 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:38662: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:49:47 host2 sshd[4027904]: Disconnected from invalid user alpha 9.223.176.221 port 59450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:52:44 host2 sshd[4029693]: Disconnected from invalid user smkim 9.223.176.221 port 54982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.107
country_id: 6252001
description:
Nov 10 12:57:37 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.107, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<I2I1dzhDEd/N0h9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 10 12:58:32 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=</Mh3ejhDkOAsyhQX>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.224.45.8
country_id: 6252001
description:
[2025-11-10 13:03:55 +0530] info [cpaneld] 24.224.45.8 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.218.200.95
country_id: 6252001
description:
[2025-11-10 13:03:57 +0530] info [cpaneld] 107.218.200.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.199.190
country_id: 6252001
description:
[2025-11-10 13:03:58 +0530] info [cpaneld] 74.132.199.190 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.102.158
country_id: 6252001
description:
[2025-11-10 13:04:06 +0530] info [whostmgrd] 104.5.102.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.72.191
country_id: 6252001
description:
[2025-11-10 13:04:17 +0530] info [cpaneld] 74.244.72.191 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.39.94
country_id: 6252001
description:
[2025-11-10 13:04:37 +0530] info [cpaneld] 74.215.39.94 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.250.19
country_id: 6252001
description:
Nov 10 13:05:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.40.250.19, lip=66.85.158.91, session=<grqdkzhDlpMUKPoT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov 10 13:08:19 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<J1F5nThDzq2s7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-10 13:08:24 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:41450: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.106.246.117
country_id: 6252001
description:
[2025-11-10 13:10:18 +0530] info [cpaneld] 131.106.246.117 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.12.68
country_id: 6252001
description:
[2025-11-10 13:10:22 +0530] info [whostmgrd] 172.113.12.68 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.188.194
country_id: 6252001
description:
[2025-11-10 13:10:10 +0530] info [cpaneld] 172.59.188.194 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.94.52
country_id: 6252001
description:
[2025-11-10 13:10:14 +0530] info [cpaneld] 172.56.94.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.227.234
country_id: 6252001
description:
[2025-11-10 13:10:39 +0530] info [cpaneld] 172.251.227.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.247.189.84
country_id: 6252001
description:
[2025-11-10 13:10:46 +0530] info [cpaneld] 158.247.189.84 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.233.65
country_id: 6252001
description:
Nov 10 13:10:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.233.65, lip=66.85.158.91, session=<DjtkpjhDBtKs7OlB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.126.184
country_id: 6252001
description:
[2025-11-10 13:10:25 +0530] info [cpaneld] 174.168.126.184 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Nov 10 13:12:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.181.104, lip=66.85.158.92, TLS, session=<PvfeqjhDRIktT7Vo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-11-10 13:17:42 dovecot_login authenticator failed for ([127.0.0.1]) [122.186.202.10]:59762: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.217.177
country_id: 289688
description:
2025-11-10 13:18:02 dovecot_login authenticator failed for ([127.0.0.1]) [78.101.217.177]:45648: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.61
country_id: 2750405
description:
Nov 10 13:19:27 host2 pure-ftpd[4044777]: (?@196.251.87.61) [INFO] New connection from 196.251.87.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-10 13:20:39 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:55511: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-10 13:20:49 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:51660: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 54.226.188.193
country_id: 6252001
description:
Nov 10 13:28:20 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=54.226.188.193, lip=66.85.158.91, TLS: Connection closed, session=<sJu/5DhDYqo24rzB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 54.226.188.193
country_id: 6252001
description:
Nov 10 13:29:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 79 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=54.226.188.193, lip=66.85.158.91, TLS: Connection closed, session=<43od5ThDXNA24rzB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-10 13:31:32 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:58251: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-10 13:31:44 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:58968: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.48.68.165
country_id: 1210997
description:
[2025-11-10 13:34:20 +0530] info [cpaneld] 182.48.68.165 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.46
country_id: 6252001
description:
Nov 10 13:35:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.46, lip=66.85.158.91, TLS, session=<OoyQ/ThDsuXN0h8u>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:35:27 host2 sshd[4053171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov 10 13:35:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3ZpWADlDhMpBMQHK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:36:36 host2 sshd[4053663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov 10 13:36:33 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS: Connection closed, session=<AqZ5AjlDSDZBMQHK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:37:27 host2 sshd[4054004]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:40:04 host2 sshd[4055139]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:40:49 host2 sshd[4055599]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:41:24 host2 sshd[4055835]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 10 13:42:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<bbsCFzlDIIanXpI/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:42:38 host2 sshd[4056475]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:43:25 host2 sshd[4056884]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:44:26 host2 sshd[4057484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.158.48.89
country_id: 6251999
description:
2025-11-10 13:47:19 dovecot_login authenticator failed for (89.48.158.104.in-addr.arpa) [104.158.48.89]:37985: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-10 13:47:43 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:60573: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.15.221
country_id: 3996063
description:
Nov 10 13:48:20 host2 sshd[4060018]: Disconnected from invalid user super 47.87.15.221 port 46010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.57
country_id: 798544
description:
Nov 10 13:48:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.246.210.57, lip=66.85.158.91, TLS, session=<iSTBKzlDONBb9tI5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.103
country_id: 3469034
description:
Nov 10 13:48:47 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.209.246.103, lip=66.85.158.91, TLS, session=<ZZn1LDlDBNS60fZn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.106
country_id: 6252001
description:
Nov 10 13:49:02 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=199.45.155.106, lip=66.85.158.92, session=<C9gRLzlDbLrHLZtq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 10 13:51:13 host2 sshd[4061472]: Disconnected from invalid user emma 51.91.98.128 port 49938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 13:53:31 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vckZPzlDUNoDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 10 13:53:35 host2 sshd[4062551]: Disconnected from invalid user muhammad 51.91.98.128 port 53148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.15.221
country_id: 3996063
description:
Nov 10 13:54:48 host2 sshd[4063672]: Disconnected from invalid user presence 47.87.15.221 port 47794 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 10 13:54:59 host2 sshd[4063736]: Disconnected from invalid user chenhao 51.91.98.128 port 54762 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 13:55:14 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gLBERTlDsMcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 13:56:14 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zLzaSDlDopQDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 10 13:57:17 host2 sshd[4065044]: Disconnected from invalid user edge 51.91.98.128 port 57968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.15.221
country_id: 3996063
description:
Nov 10 13:57:46 host2 sshd[4065210]: Disconnected from invalid user ftpuser 47.87.15.221 port 56974 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 13:59:11 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<m35lUzlDjqcDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 10 13:59:35 host2 sshd[4066226]: Disconnected from invalid user ftpuser 51.91.98.128 port 32942 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 13:59:50 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<lBi3VTlDJoIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 14:01:03 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<QPYOWjlDiqoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 14:01:45 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<WrOXXDlDqJwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 14:02:30 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9Wc5XzlDnusDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 14:04:00 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<NrWjZDlDZNQDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.15.221
country_id: 3996063
description:
Nov 10 14:04:03 host2 sshd[4069553]: Disconnected from invalid user debian 47.87.15.221 port 41822 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 10 14:04:32 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=</MeMZjlDZK8DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.87.15.221
country_id: 3996063
description:
Nov 10 14:05:40 host2 sshd[4070494]: Disconnected from invalid user ubuntu 47.87.15.221 port 45278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.140.133
country_id: 298795
description:
2025-11-10 14:10:16 dovecot_plain authenticator failed for (llarchrier) [5.26.140.133]:60496: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 14:16:02 host2 sshd[4076642]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-10 14:15:21 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:55642: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-10 14:15:52 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:60281: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.127.21
country_id: 6252001
description:
[2025-11-10 14:28:40 +0530] info [cpaneld] 76.36.127.21 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.128.161.29
country_id: 6252001
description:
[2025-11-10 14:28:47 +0530] info [cpaneld] 104.128.161.29 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.149.154
country_id: 6252001
description:
[2025-11-10 14:28:57 +0530] info [cpaneld] 76.32.149.154 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.82.246.167
country_id: 6252001
description:
[2025-11-10 14:28:34 +0530] info [cpaneld] 76.82.246.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.42.135.83
country_id: 6252001
description:
[2025-11-10 14:28:37 +0530] info [cpaneld] 98.42.135.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.135.129.131
country_id: 6252001
description:
[2025-11-10 14:28:43 +0530] info [whostmgrd] 135.135.129.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.166.190.43
country_id: 6252001
description:
[2025-11-10 14:28:49 +0530] info [cpaneld] 75.166.190.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 14:36:13 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58111: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-10 14:40:17 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:48918: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-10 14:40:20 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:34456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-10 14:40:36 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:54660: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-11-10 14:41:12 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:39801: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-10 14:43:19 dovecot_plain authenticator failed for (pricaition) [154.144.255.209]:53358: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 14:49:12 host2 sshd[4096266]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-10 14:50:59 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:37500: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-11-10 14:51:12 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:42768: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.141
country_id: 3469034
description:
Nov 10 14:57:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=168.194.154.141, lip=66.85.158.91, TLS, session=<cY5QJDpDDqiowpqN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-10 14:57:09 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:52311: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-10 14:57:16 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:56587: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.201.189
country_id: 953987
description:
Nov 10 14:57:34 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=197.234.201.189, lip=66.85.158.91, TLS, session=<kO8EIzpD7dDF6sm9>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-10 15:08:23 H=([87.120.36.32]) [87.120.36.32]:51211 F=<info@wikipedia.org> rejected RCPT <mikek@gibsontruckworld.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-10 15:17:41 dovecot_login authenticator failed for ([125.18.244.41]) [27.123.104.158]:33790: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-11-10 15:17:43 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:11599: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.32
country_id: 1269750
description:
2025-11-10 15:17:59 dovecot_login authenticator failed for (nsg-corporate-32.229.187.122.airtel.in) [122.187.229.32]:46171: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-10 15:18:22 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:38309: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-10 15:23:29 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:49654: 535 Incorrect authentication data (set_id=dmca@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-10 15:24:04 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:20316: 535 Incorrect authentication data (set_id=dmca)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 15:24:29 host2 sshd[4116000]: Disconnected from invalid user ibrahim 62.60.131.157 port 32571 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2025-11-10 15:24:50 dovecot_login authenticator failed for ([103.181.81.150]) [103.181.81.150]:39384: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-10 15:24:27 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:47953: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-10 15:25:18 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:50208: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-10 15:28:58 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:59089: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 15:38:16 host2 sshd[4124803]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.150.81
country_id: 1733045
description:
Nov 10 15:38:53 host2 sshd[4125220]: Disconnected from invalid user postgres 202.184.150.81 port 59772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.162
country_id: 3469034
description:
Nov 10 15:40:44 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=168.194.154.162, lip=66.85.158.91, TLS, session=<L2GEvTpDktKowpqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.146.206
country_id: 690791
description:
Nov 10 15:41:01 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info>, method=PLAIN, rip=37.221.146.206, lip=66.85.158.91, TLS, session=<1cmovjpD5ZIl3ZLO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.150.81
country_id: 1733045
description:
Nov 10 15:41:08 host2 sshd[4127050]: Disconnected from invalid user jhlee 202.184.150.81 port 38348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.150.81
country_id: 1733045
description:
Nov 10 15:43:59 host2 sshd[4129820]: Disconnected from invalid user testuser1 202.184.150.81 port 60426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 10 15:47:22 host2 sshd[4132798]: Disconnected from invalid user readonly 103.13.206.142 port 54656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-10 15:49:05 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:44908: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-11-10 15:49:12 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:44636: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 10 15:49:24 host2 sshd[4134279]: Disconnected from invalid user ubuntu 103.13.206.142 port 50284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.150.81
country_id: 1733045
description:
Nov 10 15:51:52 host2 sshd[4135983]: Disconnected from invalid user x 202.184.150.81 port 55438 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 10 15:53:27 host2 sshd[4137228]: Disconnected from invalid user carmen 103.13.206.142 port 36478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.150.81
country_id: 1733045
description:
Nov 10 15:54:35 host2 sshd[4138467]: Disconnected from invalid user onkar 202.184.150.81 port 56506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 10 15:55:29 host2 sshd[4139007]: Disconnected from invalid user ubuntu 103.13.206.142 port 41126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 10 15:58:38 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<nA2S/jpDQsxChJl4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 10 16:01:49 host2 sshd[4142355]: Disconnected from invalid user git 103.13.206.142 port 39568 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.156
country_id: 6252001
description:
Nov 10 16:10:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.156, lip=66.85.158.91, TLS, session=<yK2rKTtDMPaTuYSc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 16:11:30 host2 sshd[4148019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.135.92.182
country_id: 6252001
description:
[2025-11-10 16:19:39 +0530] info [cpaneld] 107.135.92.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.47.248
country_id: 6252001
description:
[2025-11-10 16:20:00 +0530] info [cpaneld] 129.222.47.248 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.151.159
country_id: 6252001
description:
[2025-11-10 16:20:02 +0530] info [cpaneld] 152.86.151.159 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.216.115.151
country_id: 6252001
description:
[2025-11-10 16:19:32 +0530] info [cpaneld] 69.216.115.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.220.133.101
country_id: 6252001
description:
[2025-11-10 16:19:44 +0530] info [cpaneld] 108.220.133.101 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.98.79.112
country_id: 6252001
description:
[2025-11-10 16:19:47 +0530] info [whostmgrd] 24.98.79.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.214.15.70
country_id: 6252001
description:
[2025-11-10 16:19:58 +0530] info [cpaneld] 67.214.15.70 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 16:23:00 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<GO28VTtDlLwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 10 16:24:37 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<7FCCWztD6usD7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 16:25:45 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<45GGXztDro0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 16:26:34 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<wK56YjtDtrwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.160
country_id: 3017382
description:
Nov 10 16:28:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.160, lip=66.85.158.92, session=<pwOrZztDA4NbxJig>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 16:27:34 host2 sshd[4156786]: Disconnected from invalid user user 2.57.121.25 port 14078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.166
country_id: 3017382
description:
Nov 10 16:27:51 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.166, lip=66.85.158.92, session=<9poKZztDg61bxJim>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 16:28:51 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<w++JajtD6p4+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.165
country_id: 3017382
description:
Nov 10 16:28:17 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.165, lip=66.85.158.92, session=<6ZyXaDtDq7tbxJil>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Nov 10 16:28:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.149, lip=66.85.158.92, session=<BuHJaDtDkZtbxJiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 16:29:17 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<7ZEsbDtDepEDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 16:29:29 host2 dovecot[1509044]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<h5TsbDtDBKsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 16:31:05 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<4CObcjtDJoMDlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.31.95.163
country_id: 3686110
description:
Nov 10 16:30:12 host2 sshd[4158324]: Disconnected from invalid user omer 186.31.95.163 port 52906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.240.224.102
country_id: 1522867
description:
2025-11-10 16:35:37 dovecot_login authenticator failed for ([82.200.223.49]) [84.240.224.102]:54148: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-10 16:35:53 dovecot_login authenticator failed for ([128.185.215.38]) [128.185.215.38]:40500: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 10 16:35:59 host2 sshd[4161505]: Disconnected from invalid user admin 79.116.35.29 port 59614 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-10 16:36:27 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:55967: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 16:38:05 host2 sshd[4162606]: Disconnected from invalid user justus 62.60.131.157 port 35744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 10 16:38:34 host2 sshd[4162909]: Disconnected from invalid user rtc 79.116.35.29 port 39766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-11-10 16:39:39 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (pascry) [95.229.5.248]:58738: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-10 16:39:49 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:65322: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.151
country_id: 1880251
description:
Nov 10 16:39:56 host2 sshd[4163507]: Disconnected from invalid user omer 45.78.218.151 port 45596 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.205
country_id: 6252001
description:
Nov 10 16:40:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.205, lip=66.85.158.92, session=<IAvokztDk8Bb5qjN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.104
country_id: 6252001
description:
Nov 10 16:40:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.104, lip=66.85.158.92, session=<YeyClDtDuaZb5qho>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.202
country_id: 6252001
description:
Nov 10 16:40:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.202, lip=66.85.158.92, session=<8miFlTtDb9Fb5qjK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.83.217.194
country_id: 1269750
description:
Nov 10 16:41:13 host2 sshd[4164478]: Disconnected from invalid user web 183.83.217.194 port 43298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 10 16:43:41 host2 sshd[4165851]: Disconnected from invalid user mc 79.116.35.29 port 56528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.83.217.194
country_id: 1269750
description:
Nov 10 16:43:46 host2 sshd[4165900]: Disconnected from invalid user moein 183.83.217.194 port 42640 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.176.238.21
country_id: 6252001
description:
[2025-11-10 16:46:38 +0530] info [cpaneld] 67.176.238.21 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.10.175.63
country_id: 6252001
description:
[2025-11-10 16:46:37 +0530] info [whostmgrd] 204.10.175.63 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.211.221.33
country_id: 6252001
description:
[2025-11-10 16:46:35 +0530] info [cpaneld] 24.211.221.33 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.175.201.153
country_id: 6252001
description:
[2025-11-10 16:46:42 +0530] info [cpaneld] 24.175.201.153 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.154.154
country_id: 6252001
description:
[2025-11-10 16:46:55 +0530] info [cpaneld] 35.147.154.154 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.254
country_id: 1733045
description:
2025-11-10 16:47:06 dovecot_login authenticator failed for ([49.124.152.254]) [49.124.152.254]:49188: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.22.138
country_id: 6252001
description:
[2025-11-10 16:46:27 +0530] info [cpaneld] 76.38.22.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.0.38.84
country_id: 6252001
description:
[2025-11-10 16:46:30 +0530] info [cpaneld] 98.0.38.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-10 16:47:16 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:57253: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.83.217.194
country_id: 1269750
description:
Nov 10 16:47:36 host2 sshd[4168587]: Disconnected from invalid user admin1 183.83.217.194 port 39770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.195.115.166
country_id: 3017382
description:
2025-11-10 16:48:36 dovecot_plain authenticator failed for ram59-h01-212-195-115-166.dsl.sta.abo.bbox.fr (theffs) [212.195.115.166]:34200: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 16:53:59 host2 sshd[4172584]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-11-10 16:55:46 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (diummorny) [174.166.153.20]:46520: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-10 16:55:50 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (emulaserm) [73.68.220.15]:53212: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.151
country_id: 1880251
description:
Nov 10 16:59:06 host2 sshd[4176679]: Disconnected from invalid user tallerv 45.78.218.151 port 39966 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 17:00:47 host2 sshd[4177796]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-11-10 17:00:56 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (tubic) [76.16.7.82]:53423: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-10 17:03:24 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:56933: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.231.195
country_id: 1227603
description:
[2025-11-10 17:07:23 +0530] info [webmaild] 212.104.231.195 - Pavindu@venee.lk  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov 10 17:09:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, TLS: Connection closed, session=<DY1A+jtDELJChJmF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.231.195
country_id: 1227603
description:
[2025-11-10 17:08:43 +0530] info [webmaild] 212.104.231.195 - pavindu@venee.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-10 17:08:56 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:22675: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-10 17:09:18 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:51682: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.231.195
country_id: 1227603
description:
[2025-11-10 17:13:35 +0530] info [webmaild] 212.104.231.195 - pavindu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user pavindu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 10 17:14:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<AtYzDTxDNIeLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-11-10 17:14:53 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (acelestion) [37.150.8.174]:40305: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 17:22:52 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<mZ+rKzxDhq4+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.234.3
country_id: 798544
description:
Nov 10 17:25:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=109.125.234.3, lip=66.85.158.91, TLS, session=<ve7RMzxDv4ttfeoD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.191
country_id: 3469034
description:
Nov 10 17:25:44 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=168.194.154.191, lip=66.85.158.91, TLS, session=<nWP3NDxDYaeowpq/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 17:28:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<I/6UQDxDHIo+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2025-11-10 17:30:05 dovecot_login authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:40084: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 17:34:13 host2 sshd[2542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 10 17:35:56 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<c/uRWjxDmNAD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-10 17:38:11 dovecot_plain authenticator failed for (ovelize) [88.207.210.23]:59704: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-11-10 17:38:57 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (ameltivi) [71.235.225.181]:36224: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-10 17:41:33 dovecot_plain authenticator failed for (emptatied) [65.20.164.137]:46012: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 10 17:44:46 host2 sshd[9041]: Disconnected from invalid user suraj 103.172.20.218 port 38464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.173.45.254
country_id: 2328926
description:
2025-11-10 17:46:01 dovecot_login authenticator failed for 62-173-45-254.rv.ipnxtelecoms.com ([197.149.125.114]) [62.173.45.254]:60994: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-10 17:46:22 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:42512: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-10 17:46:42 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-11-10 17:46:44 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:44614: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-10 17:47:31 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:47839: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Nov 10 17:47:29 host2 sshd[11336]: Disconnected from invalid user safeuser 152.32.145.111 port 59912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Nov 10 17:49:07 host2 sshd[12190]: Disconnected from invalid user deployer 152.32.145.111 port 60522 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 10 17:49:33 host2 sshd[12400]: Disconnected from invalid user ubuntu 103.172.20.218 port 36560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Nov 10 17:52:34 host2 sshd[14441]: Disconnected from invalid user cloud 152.32.145.111 port 56808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 10 17:52:54 host2 sshd[14545]: Disconnected from invalid user zulfikar 103.172.20.218 port 57172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.246
country_id: 130758
description:
Nov 10 17:53:34 host2 sshd[14978]: Disconnected from invalid user kamran 87.236.38.246 port 33372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 17:53:57 host2 sshd[15135]: Disconnected from invalid user abril 62.60.131.157 port 20048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.236.38.246
country_id: 130758
description:
Nov 10 17:54:48 host2 sshd[15972]: Disconnected from invalid user super 87.236.38.246 port 53918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.145.111
country_id: 1861060
description:
Nov 10 17:54:20 host2 sshd[15468]: Disconnected from invalid user cubrid 152.32.145.111 port 39826 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 17:58:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<EG7iqTxDhskDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 17:58:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<dICqqzxD0NMDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-10 17:58:53 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:55275: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.204.209.203
country_id: 2635167
description:
2025-11-10 17:58:23 dovecot_login authenticator failed for emerald.da.hostns.io [91.204.209.203]:48722: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 17:59:33 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VhD+rjxD5ooDlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.236.38.246
country_id: 130758
description:
Nov 10 17:59:55 host2 sshd[20094]: Disconnected from invalid user admin 87.236.38.246 port 37094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.79
country_id: 1880251
description:
Nov 10 18:00:09 host2 sshd[20386]: Disconnected from invalid user rami 45.78.206.79 port 45150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 18:01:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<sPCKtTxDAMwDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-10 18:02:51 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:56700: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-11-10 18:02:23 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (cytive) [98.192.74.183]:51532: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-10 18:03:11 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:46704: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 18:03:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<Nh/dvTxDEuoDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 18:04:04 host2 sshd[23808]: Disconnected from invalid user user 2.57.121.25 port 28355 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 18:04:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<UOfMvzxD2MoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 18:05:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DHtbwzxDrNwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 18:06:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9VoPxzxDQpgDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 18:06:57 host2 sshd[25747]: Disconnected from invalid user user 2.57.121.25 port 14394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-10 18:07:43 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:33244: 535 Incorrect authentication data (set_id=finance@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-10 18:08:01 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:55159: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 10 18:08:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<pyVbzTxDOMsDlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.206.79
country_id: 1880251
description:
Nov 10 18:13:09 host2 sshd[28545]: Disconnected from invalid user nexus 45.78.206.79 port 48144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 18:14:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7UEp5DxDaoE+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 18:21:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62491: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Nov 10 18:21:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, TLS, session=<dOeq/jxDZJU26lCA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 18:23:36 host2 sshd[34460]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.62.225.83
country_id: 6252001
description:
[2025-11-10 18:30:37 +0530] info [cpaneld] 158.62.225.83 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.241.47.78
country_id: 6252001
description:
[2025-11-10 18:30:10 +0530] info [cpaneld] 72.241.47.78 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.149.29.67
country_id: 6252001
description:
[2025-11-10 18:30:12 +0530] info [cpaneld] 67.149.29.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.220.160.34
country_id: 6252001
description:
[2025-11-10 18:30:15 +0530] info [cpaneld] 206.220.160.34 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.188.50.243
country_id: 6252001
description:
[2025-11-10 18:30:18 +0530] info [whostmgrd] 47.188.50.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.1.198.19
country_id: 6252001
description:
[2025-11-10 18:30:20 +0530] info [cpaneld] 129.1.198.19 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.174.245.21
country_id: 6252001
description:
[2025-11-10 18:30:23 +0530] info [cpaneld] 67.174.245.21 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.203.154
country_id: 6252001
description:
[2025-11-10 18:33:07 +0530] info [cpaneld] 73.71.203.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.225.188
country_id: 6252001
description:
[2025-11-10 18:33:14 +0530] info [cpaneld] 98.213.225.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.8.251.39
country_id: 6252001
description:
[2025-11-10 18:33:17 +0530] info [cpaneld] 96.8.251.39 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.194.154.197
country_id: 6252001
description:
[2025-11-10 18:33:20 +0530] info [whostmgrd] 73.194.154.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.96.213.144
country_id: 6252001
description:
[2025-11-10 18:33:21 +0530] info [cpaneld] 24.96.213.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.56.235.196
country_id: 6252001
description:
[2025-11-10 18:33:29 +0530] info [cpaneld] 134.56.235.196 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.147.104.251
country_id: 6252001
description:
[2025-11-10 18:33:31 +0530] info [cpaneld] 23.147.104.251 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.194.160
country_id: 2921044
description:
[2025-11-10 18:34:19 +0530] info [webmaild] 217.154.194.160 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-10 18:35:26 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:50138: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-11-10 18:37:32 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:56391: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 18:38:13 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<t08vOT1DUuM+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-10 18:38:25 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:40258: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-11-10 18:39:45 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (dablath) [50.74.136.134]:49008: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.88
country_id: 3469034
description:
Nov 10 18:44:35 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.216.88.88, lip=66.85.158.91, TLS, session=<31PxTj1DZci62FhY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.92.214.214
country_id: 614540
description:
Nov 10 18:44:14 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=188.92.214.214, lip=66.85.158.91, TLS, session=<YpXITT1DY4m8XNbW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-10 18:48:34 dovecot_plain authenticator failed for (hoscess) [65.20.251.71]:40662: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 10 18:48:10 host2 sshd[49182]: Disconnected from invalid user rizal 103.224.247.23 port 55372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Nov 10 18:48:14 host2 sshd[49245]: Disconnected from invalid user postgres 102.88.137.213 port 49744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Nov 10 18:49:50 host2 sshd[50095]: Disconnected from invalid user hdm 102.88.137.213 port 17188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 10 18:50:27 host2 sshd[50542]: Disconnected from invalid user admin 2.57.121.112 port 40612 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.61
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.61: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.164
country_id: 2635167
description:
Nov 10 18:51:37 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.164, lip=66.85.158.92, TLS, session=<wcg7aT1DO+1X7LCk>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Nov 10 18:54:17 host2 sshd[52886]: Disconnected from invalid user hassan 102.88.137.213 port 1195 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:54:28 host2 pure-ftpd[53243]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:55:49 host2 pure-ftpd[54228]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 18:57:12 host2 sshd[54968]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:57:11 host2 pure-ftpd[54965]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:57:16 host2 pure-ftpd[55026]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.88.188.111
country_id: 1522867
description:
2025-11-10 18:58:42 dovecot_login authenticator failed for 178.88.188.111.dynamic.telecom.kz ([127.0.0.1]) [178.88.188.111]:46768: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.122.54
country_id: 1522867
description:
2025-11-10 18:58:50 dovecot_login authenticator failed for 95.56.122.54.dynamic.telecom.kz ([127.0.0.1]) [95.56.122.54]:33177: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-11-10 18:58:59 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (distrus) [68.40.189.43]:32858: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-11-10 18:59:03 dovecot_plain authenticator failed for (horse) [65.20.133.208]:54434: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:59:04 host2 pure-ftpd[56104]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:59:09 host2 pure-ftpd[56143]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 10 18:59:09 host2 pure-ftpd[56139]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Nov 10 19:01:46 host2 sshd[57528]: Disconnected from invalid user bigbluebutton 102.88.137.213 port 33707 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 10 19:02:46 host2 sshd[58054]: Disconnected from invalid user gino 103.224.247.23 port 58646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-11-10 19:02:24 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:48316: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-11-10 19:03:19 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:51044: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Nov 10 19:04:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, TLS, session=<hEqzlT1DjOU26lCA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 19:11:33 host2 sshd[63178]: Disconnected from invalid user ivana 62.60.131.157 port 42215 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-11-10 19:13:28 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (unorementy) [174.166.153.20]:45158: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.76.84.122
country_id: 1861060
description:
2025-11-10 19:14:05 dovecot_login authenticator failed for ab084122.ppp.asahi-net.or.jp [183.76.84.122]:57798: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-11-10 19:14:37 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:61599: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-11-10 19:15:26 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:60384: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-10 19:15:49 dovecot_login authenticator failed for (89.140.17.22.static.user.ono.com) [81.0.54.119]:54504: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.254.129
country_id: 1668284
description:
Nov 10 19:18:59 host2 sshd[67930]: Disconnected from invalid user deploy 118.194.254.129 port 49764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.107
country_id: 3175395
description:
Nov 10 19:21:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.47.136.107, lip=66.85.158.91, TLS, session=<NRaf0T1DU525L4hr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.155.88.155
country_id: 2300660
description:
2025-11-10 19:21:06 dovecot_login authenticator failed for (88-155-41-155-dedicatedinternet.vodafone.com.gh) [41.155.88.155]:41418: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.195
country_id: 3865483
description:
Nov 10 19:21:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=190.122.128.195, lip=66.85.158.91, TLS, session=<UMLI0j1Ddr++eoDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-10 19:21:35 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:59609: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.254.129
country_id: 1668284
description:
Nov 10 19:22:01 host2 sshd[70044]: Disconnected from invalid user p 118.194.254.129 port 54106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Nov 10 19:22:32 host2 sshd[70292]: Disconnected from invalid user walter 207.154.247.4 port 59248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 10 19:24:37 host2 sshd[71298]: Disconnected from invalid user suporte 200.89.178.151 port 26605 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.181.234.140
country_id: 289688
description:
[2025-11-10 19:25:58 +0530] info [cpaneld] 95.181.234.140 - maximsholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 124.198.131.108
country_id: 6252001
description:
Nov 10 19:25:25 host2 pure-ftpd[71831]: (?@124.198.131.108) [INFO] New connection from 124.198.131.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.226.143
country_id: 6252001
description:
[2025-11-10 19:25:46 +0530] info [cpaneld] 173.239.226.143 - awanish "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awanish (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.84.107.222
country_id: 2661886
description:
[2025-11-10 19:25:49 +0530] info [cpaneld] 45.84.107.222 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.173.21.23
country_id: 2750405
description:
[2025-11-10 19:25:47 +0530] info [cpaneld] 158.173.21.23 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.247.16
country_id: 1562822
description:
Nov 10 19:25:24 host2 pure-ftpd[71823]: (?@173.239.247.16) [INFO] New connection from 173.239.247.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 10 19:28:05 host2 sshd[73067]: Disconnected from invalid user steam 200.89.178.151 port 28922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.16
country_id: 6252001
description:
Nov 10 19:29:52 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.16, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<e+/+8T1DM8aTuYUQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 19:30:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<13Ij8z1DmOtD1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.16
country_id: 6252001
description:
Nov 10 19:30:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.16, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3Htn8z1DpPqTuYUQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 10 19:31:00 host2 sshd[74803]: Disconnected from invalid user storage 200.89.178.151 port 31199 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 10 19:35:30 host2 sshd[77574]: Disconnected from invalid user ionadmin 200.89.178.151 port 62146 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.16
country_id: 6252001
description:
Nov 10 19:36:45 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.16, lip=66.85.158.91, TLS, session=<ckufCj5DduyTuYUQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.16
country_id: 6252001
description:
Nov 10 19:37:47 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.16, lip=66.85.158.91, TLS, session=<9XpMDj5D9POTuYUQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-10 19:39:25 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:51770: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-10 19:39:34 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:35944: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-10 19:40:10 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (saphiblen) [73.183.74.177]:46150: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-10 19:41:04 dovecot_plain authenticator failed for (boalt) [65.20.204.193]:44716: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-11-10 19:41:08 dovecot_plain authenticator failed for (burna) [105.72.176.66]:56694: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-10 19:44:26 dovecot_plain authenticator failed for (pripos) [65.20.148.165]:44874: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 19:46:46 host2 sshd[83882]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 19:47:30 host2 sshd[84215]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Nov 10 19:50:00 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rrkCOj5DKJ1ChJmM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.86.122
country_id: 2750405
description:
[2025-11-10 19:50:24 +0530] info [cpaneld] 196.251.86.122 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-11-10 19:53:56 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:33879: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-11-10 19:54:05 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:60226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-10 19:54:08 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:55086: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-10 19:53:26 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (proat) [73.197.236.163]:35880: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Nov 10 19:56:01 host2 sshd[89915]: Disconnected from invalid user hadoop 207.154.247.4 port 38000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-10 19:57:29 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:44654: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-10 19:57:48 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:33362: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-10 19:57:51 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:51940: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.154.247.4
country_id: 2921044
description:
Nov 10 19:57:54 host2 sshd[91009]: Disconnected from invalid user TestUser 207.154.247.4 port 52020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-10 19:58:18 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:55784: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 20:02:00 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<MbTSZD5DxqdD1VIS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 20:10:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<ZPXcgj5D7Jc+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 10 20:13:57 host2 sshd[101719]: Disconnected from invalid user www 107.174.26.130 port 51736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 10 20:14:18 host2 sshd[101964]: Disconnected from invalid user test 101.36.119.218 port 41254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 10 20:16:25 host2 sshd[103254]: Disconnected from invalid user h 107.174.26.130 port 59778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 10 20:17:08 host2 sshd[103719]: Disconnected from invalid user ubuntu 101.36.119.218 port 54368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-11-10 20:18:44 dovecot_login authenticator failed for ([127.0.0.1]) [149.54.15.6]:56844: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.230
country_id: 2186224
description:
2025-11-10 20:18:53 dovecot_login authenticator failed for ([127.0.0.1]) [121.73.162.230]:51744: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 10 20:18:31 host2 sshd[104468]: Disconnected from invalid user newuser 101.36.119.218 port 35106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 10 20:19:39 host2 sshd[105081]: Disconnected from invalid user admin 2.57.121.112 port 34641 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 20:20:29 host2 sshd[105739]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 10 20:21:33 host2 sshd[106292]: Disconnected from invalid user anton 107.174.26.130 port 47576 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 10 20:24:33 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<muuJtT5DCt8D7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 20:24:52 host2 sshd[108178]: Disconnected from invalid user lori 62.60.131.157 port 6127 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.129.29
country_id: 2510769
description:
Nov 10 20:24:53 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=193.30.129.29, lip=66.85.158.91, TLS, session=<aajLtT5DLtXBHoEd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.128.49
country_id: 357994
description:
2025-11-10 20:26:05 dovecot_plain authenticator failed for (pyrediate) [154.177.128.49]:44556: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.140
country_id: 3469034
description:
Nov 10 20:25:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.71.140, lip=66.85.158.91, TLS, session=<Zefntj5DJ6axLEeM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-10 20:26:00 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (aredian) [68.46.148.180]:58412: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.191.190.154
country_id: 6252001
description:
[2025-11-10 20:31:04 +0530] info [cpaneld] 76.191.190.154 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.248.28
country_id: 6252001
description:
[2025-11-10 20:31:07 +0530] info [whostmgrd] 76.39.248.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.110.224.115
country_id: 6252001
description:
[2025-11-10 20:30:50 +0530] info [cpaneld] 66.110.224.115 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.235.0.96
country_id: 6252001
description:
[2025-11-10 20:30:56 +0530] info [cpaneld] 76.235.0.96 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.59.181.68
country_id: 6252001
description:
[2025-11-10 20:31:11 +0530] info [cpaneld] 98.59.181.68 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.203.65
country_id: 6252001
description:
[2025-11-10 20:31:22 +0530] info [cpaneld] 76.141.203.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.182.247
country_id: 6252001
description:
[2025-11-10 20:31:20 +0530] info [cpaneld] 47.154.182.247 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.6.158
country_id: 6252001
description:
Nov 10 20:31:52 host2 sshd[112318]: Disconnected from invalid user adminuser 43.153.6.158 port 38438 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.108
country_id: 2017370
description:
2025-11-10 20:32:11 H=([176.126.103.108]) [176.126.103.108]:54837 F=<dpr@priv8shop.com> rejected RCPT <vastpro23@outlook.com>: Sender verify failed


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 20:33:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<5zkN1T5DCtJD1VIS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 20:33:55 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<j/D21j5DlMc+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.234
country_id: 6252001
description:
2025-11-10 20:33:57 dovecot_login authenticator failed for ([127.0.0.1]) [208.69.161.234]:60758: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-11-10 20:34:11 dovecot_login authenticator failed for ([127.0.0.1]) [117.220.10.60]:41765: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 10 20:34:20 host2 sshd[114256]: Disconnected from invalid user kibana 103.117.56.152 port 39930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.6.158
country_id: 6252001
description:
Nov 10 20:34:29 host2 sshd[114318]: Disconnected from invalid user sysadmin 43.153.6.158 port 39920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.181.4
country_id: 1861060
description:
Nov 10 20:35:03 host2 sshd[114715]: Disconnected from invalid user ventas 43.153.181.4 port 40658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.153.6.158
country_id: 6252001
description:
Nov 10 20:35:49 host2 sshd[115361]: Disconnected from invalid user server 43.153.6.158 port 43302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 10 20:35:53 host2 sshd[115417]: Disconnected from invalid user ts3server 103.117.56.152 port 46844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.181.4
country_id: 1861060
description:
Nov 10 20:36:29 host2 sshd[115779]: Disconnected from invalid user user 43.153.181.4 port 55240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.181.4
country_id: 1861060
description:
Nov 10 20:37:52 host2 sshd[116747]: Disconnected from invalid user miner 43.153.181.4 port 47736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.6.158
country_id: 6252001
description:
Nov 10 20:40:33 host2 sshd[118924]: Disconnected from invalid user guilherme 43.153.6.158 port 35336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 10 20:41:47 host2 sshd[119577]: Disconnected from invalid user fivem 103.117.56.152 port 58250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.6.158
country_id: 6252001
description:
Nov 10 20:42:57 host2 sshd[120161]: Disconnected from invalid user bloom 43.153.6.158 port 35024 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-11-10 20:45:08 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:7548: 535 Incorrect authentication data (set_id=hello@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-11-10 20:45:32 dovecot_login authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:44042: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-11-10 20:46:57 dovecot_login authenticator failed for (066249.telemar.net.br) [200.216.172.182]:49757: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2025-11-10 20:47:28 dovecot_login authenticator failed for ([49.124.159.188]) [49.124.159.188]:44928: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 20:51:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<Dlf0FD9DxOk+PIOL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-11-10 20:57:33 +0530] info [cpaneld] 149.30.139.241 - cpsess4340482927frontendpaper_lanternfilemanagerindex.html "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.143
country_id: 2186224
description:
2025-11-10 20:59:29 dovecot_login authenticator failed for ([127.0.0.1]) [121.73.161.143]:39886: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-10 20:59:39 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.57.158]:58742: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.232.209.234
country_id: 953987
description:
[2025-11-10 21:02:17 +0530] info [webmaild] 129.232.209.234 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 21:05:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<Y5fXRj9DMI5D1VIS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 10 21:08:01 host2 sshd[139297]: Disconnected from invalid user ram 45.78.193.188 port 40874 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 21:10:02 host2 sshd[140940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.159
country_id: 6252001
description:
Nov 10 21:13:02 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.159, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FQnwYj9DUUBBMQGf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 10 21:13:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<c3gvZD9DLv5BMQGY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 21:16:44 host2 sshd[146632]: Disconnected from invalid user user 2.57.121.25 port 7857 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 21:19:23 host2 sshd[148704]: Disconnected from invalid user user 2.57.121.25 port 44061 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-11-10 21:21:11 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:50612: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.86.122
country_id: 2750405
description:
[2025-11-10 21:21:18 +0530] info [cpaneld] 196.251.86.122 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.251.86.122
country_id: 2750405
description:
Nov 10 21:21:18 host2 sshd[150320]: Invalid user cloudtourssrilan_travel from 196.251.86.122 port 47244


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.11.87
country_id: 3077311
description:
Nov 10 21:21:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=31.222.11.87, lip=66.85.158.91, TLS, session=<dlY2gD9DQZ0f3gtX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-10 21:21:43 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:62277: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.233
country_id: 3175395
description:
Nov 10 21:21:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.70.204.233, lip=66.85.158.91, TLS, session=<JcdDgT9Dh9ttRszp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 10 21:23:20 host2 sshd[151737]: Disconnected from invalid user db2admin 45.78.193.188 port 47834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Nov 10 21:29:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1e0RnT9DPj9KUi8E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-10 21:34:15 dovecot_plain authenticator failed for (miancette) [102.53.15.56]:38992: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 21:37:40 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<svTwuj9DwrdD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-10 21:37:55 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:38692: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
country_id: 1269750
description:
2025-11-10 21:38:21 dovecot_login authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:40936: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 21:40:26 host2 sshd[166209]: Disconnected from invalid user gonzalo 62.60.131.157 port 5441 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.3
country_id: 2635167
description:
Nov 10 21:41:40 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.3, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ZXheyT9DisQjy9MD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.3
country_id: 2635167
description:
Nov 10 21:42:11 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.3, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<9YAvyz9DAvIjy9MD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 21:43:33 host2 sshd[168779]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-11-10 21:43:32 dovecot_login authenticator failed for ([127.0.0.1]) [191.59.214.168]:46248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 10 21:43:43 host2 sshd[168878]: Disconnected from invalid user admin 2.57.121.112 port 22853 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.148.169.56
country_id: 3144096
description:
2025-11-10 21:43:44 dovecot_login authenticator failed for 82-148-169-56.customer.obosnett.no ([127.0.0.1]) [82.148.169.56]:58515: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-10 21:44:00 dovecot_plain authenticator failed for (winbled) [24.187.213.29]:52332: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.3
country_id: 2635167
description:
Nov 10 21:49:33 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.3, lip=66.85.158.92, TLS, session=<scGU5T9DKucjy9MD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 10 22:01:58 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<HcTxEUBDsk+4affD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.91
country_id: 6252001
description:
Nov 10 22:02:08 host2 pure-ftpd[194776]: (?@147.185.132.91) [INFO] New connection from 147.185.132.91


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 10 22:02:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, TLS: Connection closed, session=<akjbEkBDgpm4affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-10 22:03:12 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.78.112
country_id: 3017382
description:
2025-11-10 22:03:49 dovecot_login authenticator failed for 217-128-78-112.ftth.fr.orangecustomers.net [217.128.78.112]:52694: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.45
country_id: 2542007
description:
Nov 10 22:04:52 host2 sshd[197267]: Disconnected from invalid user ftp2 81.192.46.45 port 56272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.45
country_id: 2542007
description:
Nov 10 22:06:08 host2 sshd[198378]: Disconnected from invalid user oracle 81.192.46.45 port 32970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.45
country_id: 2542007
description:
Nov 10 22:07:19 host2 sshd[199071]: Disconnected from invalid user tempuser 81.192.46.45 port 36894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.143.251
country_id: 3175395
description:
Nov 10 22:08:08 host2 sshd[199628]: Disconnected from invalid user pilot 151.36.143.251 port 60290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-11-10 22:09:49 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:47007: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.122.106.61
country_id: 6252001
description:
Nov 10 22:10:15 host2 sshd[201291]: Disconnected from invalid user trevor 34.122.106.61 port 47964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 80.97.160.232
country_id: 617790
description:
Nov 10 22:10:33 host2 sshd[201434]: Disconnected from invalid user will 80.97.160.232 port 38290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-10 22:10:34 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:33713: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 22:10:47 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<Lv1hMUBDOOJD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-10 22:11:07 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (makines) [73.230.86.50]:51762: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.254.239
country_id: 953987
description:
2025-11-10 22:10:08 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:45700: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.45
country_id: 2542007
description:
Nov 10 22:11:51 host2 sshd[202257]: Disconnected from invalid user alumni 81.192.46.45 port 60556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.122.106.61
country_id: 6252001
description:
Nov 10 22:11:31 host2 sshd[202101]: Disconnected from invalid user upload 34.122.106.61 port 52128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.206
country_id: 1733045
description:
2025-11-10 22:14:00 dovecot_login authenticator failed for ([49.124.148.206]) [49.124.148.206]:49606: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-10 22:13:12 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:59788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.50.100.146
country_id: 2077456
description:
2025-11-10 22:13:12 dovecot_login authenticator failed for 146.100.50.210.sta.wbroadband.net.au [210.50.100.146]:46901: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-11-10 22:13:34 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:50594: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 80.97.160.232
country_id: 617790
description:
Nov 10 22:14:25 host2 sshd[204002]: Disconnected from invalid user upload 80.97.160.232 port 51976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 22:16:28 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52175: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.142
country_id: 1880251
description:
Nov 10 22:17:41 host2 sshd[206492]: Disconnected from invalid user silas 45.78.218.142 port 48738 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.39
country_id: 953987
description:
Nov 10 22:18:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.64.42.39, lip=66.85.158.91, TLS, session=<Zsl+SkBDy5dmQCon>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.144
country_id: 1269750
description:
Nov 10 22:18:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.84.202.144, lip=66.85.158.91, TLS, session=<V/X8S0BDfOBnVMqQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 10 22:19:18 host2 sshd[207479]: Disconnected from invalid user sysadmin 170.79.37.88 port 51942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
country_id: 174982
description:
2025-11-10 22:19:41 dovecot_login authenticator failed for ([212.73.75.82]) [212.73.75.82]:43959: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-10 22:19:53 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:45292: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-11-10 22:20:19 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (divered) [71.235.225.181]:37164: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.36.73
country_id: 6252001
description:
[2025-11-10 22:21:20 +0530] info [cpaneld] 76.150.36.73 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.171.87.95
country_id: 6252001
description:
[2025-11-10 22:21:24 +0530] info [cpaneld] 73.171.87.95 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.79.52.127
country_id: 6252001
description:
[2025-11-10 22:21:28 +0530] info [whostmgrd] 108.79.52.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.17.5.62
country_id: 6252001
description:
[2025-11-10 22:21:30 +0530] info [cpaneld] 108.17.5.62 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.250.75.58
country_id: 6252001
description:
[2025-11-10 22:21:48 +0530] info [cpaneld] 24.250.75.58 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.38.231
country_id: 6252001
description:
[2025-11-10 22:21:13 +0530] info [cpaneld] 73.74.38.231 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.155.65.198
country_id: 3017382
description:
Nov 10 22:23:05 host2 sshd[209512]: Disconnected from invalid user itadmin 34.155.65.198 port 56616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 10 22:24:49 host2 sshd[210379]: Disconnected from invalid user user123 170.79.37.88 port 34684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 10 22:25:52 host2 sshd[211196]: Disconnected from invalid user node 170.79.37.88 port 59734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 10 22:26:18 host2 sshd[211527]: Disconnected from invalid user ctf 170.79.37.88 port 41452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.157
country_id: 1880251
description:
Nov 10 22:28:15 host2 sshd[212802]: Disconnected from invalid user ubuntu 45.78.220.157 port 41358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.163.151.210
country_id: 3017382
description:
Nov 10 22:28:24 host2 sshd[212882]: Disconnected from invalid user tester 34.163.151.210 port 35496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-10 22:28:58 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (gened) [73.213.237.28]:50850: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 10 22:29:00 host2 sshd[213230]: Received disconnect from 170.79.37.88 port 57176:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.155.65.198
country_id: 3017382
description:
Nov 10 22:30:13 host2 sshd[214123]: Disconnected from invalid user adminuser 34.155.65.198 port 44090 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.103.36.205
country_id: 6252001
description:
[2025-11-10 22:32:02 +0530] info [cpaneld] 68.103.36.205 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.126.68.148
country_id: 6252001
description:
[2025-11-10 22:32:03 +0530] info [cpaneld] 172.126.68.148 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 22:32:43 host2 sshd[215398]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.207.1.99
country_id: 6252001
description:
[2025-11-10 22:32:10 +0530] info [cpaneld] 108.207.1.99 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.65.178
country_id: 6252001
description:
[2025-11-10 22:32:13 +0530] info [whostmgrd] 108.88.65.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.155.65.198
country_id: 3017382
description:
Nov 10 22:33:02 host2 sshd[215545]: Disconnected from invalid user mario 34.155.65.198 port 49208 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.233.111.201
country_id: 6252001
description:
[2025-11-10 22:32:18 +0530] info [cpaneld] 24.233.111.201 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.51.66.246
country_id: 6252001
description:
[2025-11-10 22:32:22 +0530] info [cpaneld] 136.51.66.246 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.71.199.93
country_id: 6252001
description:
[2025-11-10 22:32:27 +0530] info [cpaneld] 206.71.199.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-10 22:32:31 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:62861: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-11-10 22:34:42 dovecot_plain authenticator failed for (paric) [5.11.140.219]:58318: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.157
country_id: 1880251
description:
Nov 10 22:36:23 host2 sshd[217354]: Disconnected from invalid user luo 45.78.220.157 port 52136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.163.151.210
country_id: 3017382
description:
Nov 10 22:36:41 host2 sshd[217477]: Disconnected from invalid user testuser 34.163.151.210 port 57338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-10 22:37:43 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:32834: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-10 22:38:26 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:41019: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-10 22:38:52 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:54702: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.85
country_id: 1733045
description:
2025-11-10 22:39:16 dovecot_login authenticator failed for ([49.124.151.85]) [49.124.151.85]:47150: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.163.151.210
country_id: 3017382
description:
Nov 10 22:40:08 host2 sshd[219220]: Disconnected from invalid user administrator 34.163.151.210 port 32816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-10 22:40:41 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (cianchist) [68.82.141.145]:36472: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.33.77.205
country_id: 1880251
description:
Nov 10 22:40:33 host2 sshd[219497]: Disconnected from invalid user git 101.33.77.205 port 57204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-10 22:40:38 dovecot_plain authenticator failed for (rageaps) [65.20.148.165]:60930: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.33.77.205
country_id: 1880251
description:
Nov 10 22:41:58 host2 sshd[220136]: Disconnected from invalid user cxy 101.33.77.205 port 33456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 22:42:26 host2 sshd[220398]: Disconnected from invalid user nehemiah 62.60.131.157 port 16066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-10 22:43:57 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (overny) [69.123.219.82]:49844: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 22:44:36 host2 sshd[222366]: Disconnected from invalid user nehemiah 62.60.131.157 port 57155 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 22:44:18 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<2tk8qUBDip1D1VIS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.45.236.146
country_id: 6252001
description:
[2025-11-10 22:45:36 +0530] info [cpaneld] 73.45.236.146 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.80.222.156
country_id: 6252001
description:
[2025-11-10 22:45:08 +0530] info [cpaneld] 67.80.222.156 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.166.209.52
country_id: 6252001
description:
[2025-11-10 22:45:11 +0530] info [cpaneld] 76.166.209.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.132.154.71
country_id: 6252001
description:
[2025-11-10 22:45:12 +0530] info [cpaneld] 69.132.154.71 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.86.11.169
country_id: 6252001
description:
[2025-11-10 22:45:19 +0530] info [whostmgrd] 76.86.11.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.61.95
country_id: 6252001
description:
[2025-11-10 22:45:30 +0530] info [cpaneld] 47.7.61.95 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.153.97
country_id: 6252001
description:
[2025-11-10 22:45:34 +0530] info [cpaneld] 76.33.153.97 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-11-10 22:47:35 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (scence) [174.166.153.20]:50470: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-10 22:51:01 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:42932: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-11-10 22:51:15 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:33932: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-11-10 22:56:11 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:45744: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.174
country_id: 1733045
description:
2025-11-10 22:56:23 dovecot_login authenticator failed for ([49.124.154.174]) [49.124.154.174]:46346: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Nov 10 23:00:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.91, session=<YlPj4kBDrne4aYtE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.206.245.107
country_id: 1227603
description:
[2025-11-10 23:01:07 +0530] info [cpaneld] 116.206.245.107 - anandaob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 10 23:02:09 host2 sshd[231917]: Disconnected from invalid user koha 118.194.230.250 port 34530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Nov 10 23:02:23 host2 sshd[232030]: Disconnected from invalid user zahid 172.191.157.64 port 47364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 10 23:03:54 host2 sshd[233145]: Disconnected from invalid user reza 118.194.230.250 port 34658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.157.64
country_id: 6252001
description:
Nov 10 23:05:00 host2 sshd[233768]: Disconnected from invalid user odoo 172.191.157.64 port 58276 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 23:05:50 host2 sshd[234320]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 10 23:05:26 host2 sshd[234159]: Disconnected from invalid user admin 2.57.121.112 port 53247 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Nov 10 23:06:20 host2 sshd[234600]: Disconnected from invalid user accounting 172.191.157.64 port 37696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 10 23:06:36 host2 sshd[234684]: Disconnected from invalid user tet 118.194.230.250 port 34886 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 10 23:09:18 host2 sshd[235975]: Disconnected from invalid user kamal 118.194.230.250 port 35112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Nov 10 23:13:16 host2 sshd[238514]: Disconnected from invalid user kevin 172.191.157.64 port 59238 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.190
country_id: 6252001
description:
Nov 10 23:14:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.190, lip=66.85.158.92, session=<Vp71FEFDn3tAPpy+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 10 23:14:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS: Connection closed, session=<1dLEFUFDjmBAPpy2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.237.188.133
country_id: 3469034
description:
Nov 10 23:14:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=186.237.188.133, lip=66.85.158.91, TLS, session=<gK3gFEFDV5C67byF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.159.43
country_id: 690791
description:
Nov 10 23:14:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.159.43, lip=66.85.158.91, TLS, session=<V+gfFkFDW40l3Z8r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-10 23:16:22 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (pentumman) [24.91.103.202]:41082: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 23:16:22 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<hJfpG0FDNMdD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-10 23:21:03 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (catic) [73.213.236.66]:45110: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 23:20:56 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<Eck2LEFDDrs+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Nov 10 23:28:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, session=<uVDnRUFDljS4aff8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-11-10 23:27:09 dovecot_plain authenticator failed for (nalik) [65.20.129.28]:35313: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-10 23:27:36 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:32847: 535 Incorrect authentication data (set_id=newsletter@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.33.241
country_id: 1643084
description:
2025-11-10 23:27:56 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.164.33.241]:43846: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2025-11-10 23:28:09 dovecot_login authenticator failed for ([130.185.102.59]) [130.185.102.59]:50842: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Nov 10 23:28:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, TLS: Connection closed, session=<Sye1RkFDYF64aff8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-11-10 23:28:31 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:45417: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-10 23:30:33 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (eurity) [67.173.58.47]:34376: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 10 23:42:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2101eEFDft64affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 10 23:48:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<4iycj0FDMIND1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.40.218
country_id: 6252001
description:
2025-11-10 23:48:13 dovecot_plain authenticator failed for c-68-37-40-218.hsd1.mi.comcast.net (contrade) [68.37.40.218]:42748: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-10 23:52:12 dovecot_plain authenticator failed for (numaurr) [24.105.248.218]:42742: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 23:54:39 host2 sshd[263792]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-11 00:00:24 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:37886: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.25.183.157
country_id: 1605651
description:
2025-11-11 00:00:33 dovecot_login authenticator failed for node-109p.pool-125-25.dynamic.nt-isp.net (node-109p.pool-125-25.dynamic.totinternet.net) [125.25.183.157]:51167: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-11 00:00:44 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:43987: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-11 00:00:55 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:45219: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-11-11 00:06:34 dovecot_plain authenticator failed for (delintess) [92.62.243.175]:57774: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.162.214.53
country_id: 6252001
description:
[2025-11-11 00:06:53 +0530] info [cpaneld] 71.162.214.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.29.219.128
country_id: 6252001
description:
[2025-11-11 00:06:56 +0530] info [cpaneld] 45.29.219.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.164.13
country_id: 6252001
description:
[2025-11-11 00:07:25 +0530] info [cpaneld] 132.147.164.13 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.90.185
country_id: 6252001
description:
Nov 11 00:07:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=64.227.90.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<xyYu00FDoKxA41q5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.33.236
country_id: 6252001
description:
[2025-11-11 00:07:09 +0530] info [cpaneld] 173.63.33.236 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.72.81.76
country_id: 6252001
description:
[2025-11-11 00:07:12 +0530] info [whostmgrd] 71.72.81.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.24
country_id: 6252001
description:
[2025-11-11 00:07:16 +0530] info [cpaneld] 172.59.131.24 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.178.149
country_id: 6252001
description:
[2025-11-11 00:07:20 +0530] info [cpaneld] 76.33.178.149 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.60.13
country_id: 3469034
description:
2025-11-11 00:09:17 dovecot_login authenticator failed for clientes-60.13.dbug.com.br [177.10.60.13]:42369: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-11 00:09:27 dovecot_login authenticator failed for ([128.185.199.14]) [128.185.199.14]:37302: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 11 00:10:51 host2 sshd[274614]: Disconnected from invalid user usher 157.66.34.121 port 36490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.204.236
country_id: 3469034
description:
Nov 11 00:11:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=179.189.204.236, lip=66.85.158.91, TLS, session=<s/fn4EFDmoWzvczs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.5
country_id: 3175395
description:
Nov 11 00:12:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=195.177.113.5, lip=66.85.158.91, TLS, session=<LRY24kFDhdDDsXEF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-11 00:18:37 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (rampmess) [98.204.134.124]:37914: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.192
country_id: 6252001
description:
Nov 11 00:18:42 host2 pure-ftpd[279721]: (?@198.235.24.192) [INFO] New connection from 198.235.24.192


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 11 00:20:17 host2 sshd[280602]: Disconnected from invalid user dev 157.66.34.121 port 53932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 00:21:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<SslSBEJDMK1D1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 00:24:42 host2 sshd[282487]: Disconnected from invalid user admin 2.57.121.112 port 34621 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 00:27:32 host2 sshd[284089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.194
country_id: 6252001
description:
Nov 11 00:27:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.194, lip=66.85.158.91, TLS, session=<wRg7GUJDAu/N0h/C>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.144.14.142
country_id: 6252001
description:
[2025-11-11 00:28:39 +0530] info [cpaneld] 98.144.14.142 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.214.89.147
country_id: 6252001
description:
[2025-11-11 00:28:52 +0530] info [cpaneld] 107.214.89.147 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.49.41.92
country_id: 6252001
description:
[2025-11-11 00:28:54 +0530] info [cpaneld] 76.49.41.92 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.83.95.41
country_id: 6252001
description:
[2025-11-11 00:28:24 +0530] info [cpaneld] 137.83.95.41 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.212.99
country_id: 6252001
description:
[2025-11-11 00:28:28 +0530] info [cpaneld] 172.59.212.99 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.9.243.66
country_id: 6252001
description:
[2025-11-11 00:28:33 +0530] info [cpaneld] 172.9.243.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.134.76
country_id: 6252001
description:
[2025-11-11 00:28:36 +0530] info [whostmgrd] 71.193.134.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-11 00:36:23 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:38511: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-11-11 00:36:12 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:58224: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Nov 11 00:38:57 host2 sshd[290696]: Disconnected from invalid user saeed 200.73.135.75 port 53898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 11 00:41:15 host2 sshd[292320]: Disconnected from invalid user jhcho 152.32.201.226 port 28632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.38.209
country_id: 1643084
description:
Nov 11 00:43:41 host2 sshd[293448]: Disconnected from invalid user compiler 103.31.38.209 port 50276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 11 00:46:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<fw6dXEJDNshChJmK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 11 00:46:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<S20JXUJDDKlChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.38.209
country_id: 1643084
description:
Nov 11 00:47:19 host2 sshd[296437]: Disconnected from invalid user admin 103.31.38.209 port 54628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Nov 11 00:48:36 host2 sshd[297058]: Disconnected from invalid user lruiz 200.73.135.75 port 46642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 11 00:49:17 host2 sshd[297408]: Disconnected from invalid user marc 152.32.201.226 port 22856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-11 00:50:22 dovecot_plain authenticator failed for (finede) [76.190.155.43]:47375: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.235.145.72
country_id: 1880251
description:
[2025-11-11 00:51:50 +0530] info [cpaneld] 15.235.145.72 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 11 00:52:30 host2 sshd[299387]: Disconnected from invalid user angela 152.32.201.226 port 31550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Nov 11 00:53:51 host2 sshd[300098]: Disconnected from invalid user mminchenok 200.73.135.75 port 57152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-11 00:54:44 dovecot_plain authenticator failed for (jibble) [64.72.74.162]:52165: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Nov 11 00:59:15 host2 sshd[304389]: Disconnected from invalid user test 200.73.135.75 port 39438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.43
country_id: 3865483
description:
Nov 11 01:02:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=186.64.71.43, lip=66.85.158.91, TLS, session=<y+DvlUJDs7K6QEcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-11 01:02:56 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:10498: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-11 01:03:07 dovecot_login authenticator failed for (177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:54923: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.142.134.253
country_id: 298795
description:
Nov 11 01:02:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=95.142.134.253, lip=66.85.158.91, TLS, session=<EGgzl0JDwbJfjob9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-11 01:02:51 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (surcrown) [73.213.237.28]:35720: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 01:08:33 host2 sshd[310174]: Disconnected from invalid user darby 62.60.131.157 port 19049 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-11-11 01:08:45 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:55654: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-11 01:08:55 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:44959: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.8.221
country_id: 6252001
description:
Nov 11 01:13:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=45.79.8.221, lip=66.85.158.92, session=<450KwEJDB70tTwjd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 01:16:07 host2 sshd[315295]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-11 01:19:44 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pistoss) [87.103.126.54]:43165: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 11 01:25:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ALhe6UJD8ss+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 01:27:19 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<Ll078EJDmJJD1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.49.93
country_id: 6252001
description:
Nov 11 01:29:53 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.29.49.93, lip=66.85.158.92, TLS handshaking: Connection closed, session=<anqM+UJDBIEUHTFd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-11-11 01:38:10 dovecot_plain authenticator failed for (vacing) [109.226.14.93]:40623: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Nov 11 01:38:34 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, session=<00aRGENDYNOs6yiD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 01:46:19 host2 sshd[334381]: Disconnected from invalid user user 2.57.121.25 port 7792 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.150.158.62
country_id: 6252001
description:
[2025-11-11 01:50:16 +0530] info [cpaneld] 97.150.158.62 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.253.241.186
country_id: 6252001
description:
[2025-11-11 01:50:20 +0530] info [cpaneld] 147.253.241.186 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.99.253.168
country_id: 6252001
description:
[2025-11-11 01:50:24 +0530] info [whostmgrd] 73.99.253.168 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.123.138
country_id: 6252001
description:
[2025-11-11 01:50:07 +0530] info [cpaneld] 67.172.123.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.79.179.211
country_id: 6252001
description:
[2025-11-11 01:50:33 +0530] info [cpaneld] 38.79.179.211 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.18.77.61
country_id: 6252001
description:
[2025-11-11 01:50:34 +0530] info [cpaneld] 38.18.77.61 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.191.6.109
country_id: 6252001
description:
[2025-11-11 01:50:37 +0530] info [cpaneld] 75.191.6.109 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.158.189.134
country_id: 2400553
description:
2025-11-11 01:50:55 dovecot_plain authenticator failed for (bribled) [41.158.189.134]:60527: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 02:00:42 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<QdCeZ0ND+LxD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-11 02:02:27 dovecot_login authenticator failed for (abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:38688: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-11 02:01:57 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (sulah) [174.59.253.88]:45350: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.220.40.131
country_id: 6252001
description:
[2025-11-11 02:03:40 +0530] info [cpaneld] 47.220.40.131 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.223.61.226
country_id: 6252001
description:
[2025-11-11 02:03:42 +0530] info [cpaneld] 97.223.61.226 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.228.234.118
country_id: 6252001
description:
[2025-11-11 02:03:43 +0530] info [whostmgrd] 76.228.234.118 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.96.105.212
country_id: 6252001
description:
[2025-11-11 02:04:00 +0530] info [cpaneld] 174.96.105.212 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.130.151
country_id: 6252001
description:
[2025-11-11 02:04:02 +0530] info [cpaneld] 173.70.130.151 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.160.210
country_id: 2921044
description:
Nov 11 02:04:11 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.160.210, lip=66.85.158.92, TLS handshaking: Connection closed, session=<I7gpdEND6KakXKDS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 02:08:05 host2 sshd[348434]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-11 02:09:18 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 11 02:19:45 host2 sshd[355232]: Disconnected from invalid user test01 172.208.24.217 port 28048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-11 02:20:00 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (gateman) [71.224.169.28]:58556: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-11 02:21:45 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:53570: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-11 02:21:59 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:50379: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 11 02:22:16 host2 sshd[357037]: Disconnected from invalid user test01 50.6.226.167 port 38236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 11 02:23:32 host2 sshd[357665]: Disconnected from invalid user angela 172.208.24.217 port 50996 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 11 02:25:35 host2 sshd[359083]: Disconnected from invalid user omar 50.6.226.167 port 33636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 11 02:27:48 host2 sshd[360177]: Disconnected from invalid user myftp 50.6.226.167 port 54676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 11 02:28:47 host2 sshd[360796]: Disconnected from invalid user sambauser 172.208.24.217 port 9832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 11 02:28:53 host2 sshd[360887]: Disconnected from invalid user walter 50.6.226.167 port 48534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.138
country_id: 690791
description:
Nov 11 02:29:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.17.124.138, lip=66.85.158.91, TLS, session=<BAHqzUNDK8K5EXyK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.163
country_id: 953987
description:
Nov 11 02:29:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.47.163, lip=66.85.158.91, TLS, session=<ahQaz0NDoOpmQC+j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-11 02:30:57 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:46618: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-11 02:31:18 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:12885: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 11 02:31:22 host2 sshd[362584]: Disconnected from invalid user angela 172.208.24.217 port 17496 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.243
country_id: 690791
description:
2025-11-11 02:31:42 H=([45.144.212.243]) [45.144.212.243]:50003 F=<dpr@priv8shop.com> rejected RCPT <bar_hockman@hotmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-11 02:34:19 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:63755: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 02:34:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<fa4K4END0uZD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-11-11 02:39:10 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (fentiong) [73.27.33.174]:40452: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-11 02:39:18 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (bricid) [73.13.220.220]:40552: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 02:40:51 host2 sshd[369252]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-11 02:42:22 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59800: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-11 02:46:31 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:58476: 535 Incorrect authentication data (set_id=autoreply@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-11-11 02:46:44 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:38624: 535 Incorrect authentication data (set_id=autoreply)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.214.60.73
country_id: 2921044
description:
[2025-11-11 02:51:56 +0530] info [cpaneld] 85.214.60.73 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 11 02:55:21 host2 sshd[377843]: Disconnected from invalid user user1 164.90.225.61 port 55418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-11 02:59:42 dovecot_plain authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net (snered) [50.127.177.194]:50617: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 03:02:11 host2 sshd[381368]: Disconnected from invalid user admin 2.57.121.112 port 16799 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.209
country_id: 6252001
description:
Nov 11 03:03:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.209, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<b+9CR0RDDdDG6xjR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.139.221.154
country_id: 6252001
description:
[2025-11-11 03:04:59 +0530] info [whostmgrd] 73.139.221.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 03:08:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<qTQQWURDSqND1VIS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.187
country_id: 3469034
description:
Nov 11 03:20:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=190.89.136.187, lip=66.85.158.91, TLS, session=<DNffg0RD8rO+WYi7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.194.240
country_id: 798544
description:
Nov 11 03:20:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=213.92.194.240, lip=66.85.158.91, TLS, session=<RWgehURD7IHVXMLw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.150
country_id: 1880251
description:
Nov 11 03:21:24 host2 sshd[393261]: Disconnected from invalid user lana 45.78.222.150 port 50850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-11 03:22:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (loideis) [87.103.126.54]:49114: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.207.155
country_id: 2635167
description:
Nov 11 03:23:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=123.58.207.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jxtdj0RD6Ol7Os+b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.207.155
country_id: 2635167
description:
Nov 11 03:23:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=123.58.207.155, lip=66.85.158.92, TLS handshaking: Connection closed, session=<P8T5j0RD7Ol7Os+b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-11 03:27:14 dovecot_plain authenticator failed for (hereforeed) [65.20.143.159]:53734: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 03:29:20 host2 sshd[397979]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 11 03:35:06 host2 sshd[401203]: Disconnected from invalid user testuser 31.57.201.96 port 55840 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.207.155
country_id: 2635167
description:
Nov 11 03:35:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=123.58.207.155, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<z9CPuURDiqt7Os+b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.207.155
country_id: 2635167
description:
Nov 11 03:35:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=123.58.207.155, lip=66.85.158.91, TLS, session=<g3NLu0RDJOx7Os+b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 11 03:38:20 host2 sshd[402991]: Disconnected from invalid user myuser 31.57.201.96 port 43196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.222.150
country_id: 1880251
description:
Nov 11 03:41:36 host2 sshd[404725]: Disconnected from invalid user ubuntu 45.78.222.150 port 58200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 03:42:14 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<LQ250kRDhs5D1VIS>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.108
country_id: 2017370
description:
2025-11-11 03:48:15 H=([176.126.103.108]) [176.126.103.108]:64358 F=<dpr@priv8shop.com> rejected RCPT <vastpro23@outlook.com>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 11 03:50:27 host2 sshd[411820]: Disconnected from invalid user neo4j 31.57.201.96 port 39190 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 11 03:55:35 host2 sshd[415800]: Disconnected from invalid user dmp 31.57.201.96 port 40282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.88.232.183
country_id: 1605651
description:
Nov 11 03:58:15 host2 sshd[418219]: Disconnected from invalid user ubuntu 183.88.232.183 port 55442 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.88.232.183
country_id: 1605651
description:
Nov 11 04:00:52 host2 sshd[420811]: Disconnected from invalid user gf 183.88.232.183 port 56956 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 04:02:09 host2 sshd[422181]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.88.232.183
country_id: 1605651
description:
Nov 11 04:02:14 host2 sshd[422227]: Disconnected from invalid user erpnext 183.88.232.183 port 57726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Nov 11 04:08:03 host2 sshd[427537]: Disconnected from invalid user ubuntu 45.232.73.84 port 43892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.219
country_id: 6252001
description:
Nov 11 04:10:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.219, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VP6NN0VDs93N0h/b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Nov 11 04:12:08 host2 sshd[431009]: Disconnected from invalid user ubuntu 45.232.73.84 port 44742 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 96.126.117.80
country_id: 6252001
description:
Nov 11 04:14:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=96.126.117.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3awrRUVDbt5gfnVQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.75.41
country_id: 6252001
description:
Nov 11 04:14:18 host2 sshd[433440]: Disconnected from invalid user lemon 206.189.75.41 port 35550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.64
country_id: 1880251
description:
Nov 11 04:14:29 host2 sshd[433552]: Disconnected from invalid user wwww 45.78.228.64 port 57448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.75.41
country_id: 6252001
description:
Nov 11 04:15:27 host2 sshd[434691]: Disconnected from invalid user user1 206.189.75.41 port 42464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Nov 11 04:16:15 host2 sshd[435307]: Disconnected from invalid user tmax 103.217.145.104 port 47432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 04:16:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<IG8QTkVDQotD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.75.41
country_id: 6252001
description:
Nov 11 04:18:47 host2 sshd[437427]: Disconnected from invalid user qwerty 206.189.75.41 port 33504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.145.104
country_id: 1643084
description:
Nov 11 04:19:45 host2 sshd[438160]: Disconnected from invalid user hung 103.217.145.104 port 60710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 04:19:51 host2 sshd[438196]: Disconnected from invalid user admin 2.57.121.112 port 46317 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.230
country_id: 1880251
description:
Nov 11 04:20:34 host2 sshd[438964]: Disconnected from invalid user erpnext 101.47.160.230 port 48466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 04:20:57 host2 sshd[439354]: Disconnected from invalid user admin 2.57.121.112 port 11854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Nov 11 04:21:33 host2 sshd[439920]: Disconnected from invalid user nakano 103.217.145.104 port 42990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.64
country_id: 1880251
description:
Nov 11 04:22:26 host2 sshd[440416]: Disconnected from invalid user harry 45.78.228.64 port 56498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Nov 11 04:23:32 host2 sshd[441334]: Disconnected from invalid user test 45.232.73.84 port 43690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.64
country_id: 1880251
description:
Nov 11 04:25:04 host2 sshd[442882]: Disconnected from invalid user acs 45.78.228.64 port 58784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Nov 11 04:24:59 host2 sshd[442747]: Disconnected from invalid user socksuser 103.217.145.104 port 60570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.224
country_id: 6252001
description:
Nov 11 04:26:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.224, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Vd3jcEVDK9bG6xjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.135
country_id: 298795
description:
Nov 11 04:33:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=149.34.211.135, lip=66.85.158.91, TLS, session=<Hv/7iEVD/oqVItOH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.81
country_id: 2300660
description:
Nov 11 04:33:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=41.139.5.81, lip=66.85.158.91, TLS, session=<BvO9h0VDYLMpiwVR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.137.43
country_id: 6252001
description:
Nov 11 04:40:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.98.137.43, lip=66.85.158.91, session=<mDZSo0VD2L8UYokr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.116.45
country_id: 1819730
description:
Nov 11 04:43:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=101.36.116.45, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2b9brEVDKo9lJHQt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.116.45
country_id: 1819730
description:
Nov 11 04:43:33 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=101.36.116.45, lip=66.85.158.92, TLS, session=<igYbrkVDIJNlJHQt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.154
country_id: 798544
description:
Nov 11 04:43:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=178.216.30.154, lip=66.85.158.91, TLS, session=<l4ZorUVDBoWy2B6a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.49.152.114
country_id: 3996063
description:
Nov 11 04:43:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=38.49.152.114, lip=66.85.158.91, TLS, session=<lUx6rkVDq+MmMZhy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.160.230
country_id: 1880251
description:
Nov 11 04:46:58 host2 sshd[458704]: Disconnected from invalid user common 101.47.160.230 port 46622 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 04:50:38 host2 sshd[460712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 04:51:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<iyiFykVDHLdD1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.116.45
country_id: 1819730
description:
Nov 11 05:05:02 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=101.36.116.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5vX2+kVDqJxlJHQt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.116.45
country_id: 1819730
description:
Nov 11 05:05:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=101.36.116.45, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<T+DQ/UVDcMNlJHQt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.18
country_id: 6252001
description:
Nov 11 05:17:46 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.18, lip=66.85.158.92, session=<rUOAKEZD0LENWX0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 11 05:19:26 host2 sshd[476729]: Disconnected from invalid user smbuser 103.243.27.122 port 46602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 11 05:20:38 host2 sshd[477435]: Disconnected from invalid user rex 103.243.27.122 port 47302 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 05:23:29 host2 sshd[478895]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 11 05:23:00 host2 sshd[478642]: Disconnected from invalid user administrator 103.243.27.122 port 48730 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 05:26:53 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<WLzzSEZDNOJD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.22.116
country_id: 6252001
description:
2025-11-11 05:27:42 dovecot_login authenticator failed for (ADMIN) [158.173.22.116]:44641: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-11 05:29:47 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:57089: 535 Incorrect authentication data (set_id=billing@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-11 05:30:16 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:34150: 535 Incorrect authentication data (set_id=billing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-11-11 05:34:12 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:38764: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2025-11-11 05:34:35 dovecot_login authenticator failed for ([49.124.148.192]) [49.124.148.192]:46958: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 05:37:11 host2 sshd[499770]: Disconnected from invalid user admin 2.57.121.112 port 31190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-11 05:38:36 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:53833: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-11-11 05:38:41 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:18707: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-11 05:38:51 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:36860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.231
country_id: 1880251
description:
Nov 11 05:39:42 host2 sshd[500924]: Disconnected from invalid user user 101.47.160.231 port 38566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.20
country_id: 953987
description:
Nov 11 05:39:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.129.55.20, lip=66.85.158.91, TLS, session=<RxJYdkZDGJ5mgTcU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.69
country_id: 2921044
description:
Nov 11 05:40:09 host2 sshd[501431]: Disconnected from invalid user vas 46.101.206.69 port 52624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.106
country_id: 3469034
description:
Nov 11 05:40:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.216.88.106, lip=66.85.158.91, TLS, session=<1R6gd0ZDCKK62Fhq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.54.246
country_id: 3865483
description:
2025-11-11 05:40:25 dovecot_login authenticator failed for ([170.83.54.246]) [170.83.54.246]:33311: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.160.231
country_id: 1880251
description:
Nov 11 05:42:15 host2 sshd[502316]: Disconnected from invalid user dc 101.47.160.231 port 55662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 11 05:42:26 host2 sshd[502397]: Disconnected from invalid user panel 193.106.245.20 port 34020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.30.100
country_id: 1269750
description:
Nov 11 05:44:19 host2 sshd[503635]: Disconnected from invalid user ubuntu 122.160.30.100 port 46210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 11 05:44:45 host2 sshd[503870]: Disconnected from invalid user sunrise 157.230.85.50 port 48382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 11 05:45:52 host2 sshd[504861]: Disconnected from invalid user majid 157.230.85.50 port 34142 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Nov 11 05:45:55 host2 sshd[504872]: Disconnected from invalid user wk 193.106.245.20 port 52788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.30.100
country_id: 1269750
description:
Nov 11 05:46:59 host2 sshd[505390]: Disconnected from invalid user anshul 122.160.30.100 port 5046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 11 05:46:50 host2 sshd[505359]: Disconnected from invalid user elastic 38.100.203.79 port 52778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.38.18
country_id: 2542007
description:
2025-11-11 05:48:35 dovecot_plain authenticator failed for ([169.254.241.192]) [196.75.38.18]:22443: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 11 05:49:57 host2 sshd[506475]: Disconnected from invalid user anna 38.100.203.79 port 46132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 11 05:52:14 host2 sshd[508012]: Disconnected from invalid user vas 157.230.85.50 port 42008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 11 05:51:32 host2 sshd[507539]: Disconnected from invalid user wk 38.100.203.79 port 35308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.231
country_id: 1880251
description:
Nov 11 06:02:41 host2 sshd[513619]: Disconnected from invalid user cinema 101.47.160.231 port 57830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 06:02:56 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<2s7myUZDEKBD1VIS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 06:11:57 host2 sshd[519425]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-11 06:14:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61588: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-11-11 06:15:26 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:52682: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-11-11 06:15:36 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:43445: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-11-11 06:16:21 dovecot_login authenticator failed for ([65.20.250.93]) [65.20.250.93]:40786: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.106.95.252
country_id: 6252001
description:
Nov 11 06:24:21 host2 sshd[525857]: Disconnected from invalid user default 185.106.95.252 port 59472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 11 06:26:13 host2 sshd[526737]: Disconnected from invalid user sandra 52.183.128.237 port 33436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.106.95.252
country_id: 6252001
description:
Nov 11 06:26:36 host2 sshd[526892]: Disconnected from invalid user pacs 185.106.95.252 port 41544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 06:26:48 host2 sshd[526963]: Disconnected from invalid user user 2.57.121.25 port 52436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 11 06:28:53 host2 sshd[528145]: Disconnected from invalid user git 52.183.128.237 port 34252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.106.95.252
country_id: 6252001
description:
Nov 11 06:29:07 host2 sshd[528419]: Disconnected from invalid user sc 185.106.95.252 port 57752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 11 06:29:12 host2 sshd[528450]: Disconnected from invalid user debian 130.107.240.11 port 32794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 11 06:30:28 host2 sshd[529278]: Disconnected from invalid user pacs 130.107.240.11 port 53534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.106.95.252
country_id: 6252001
description:
Nov 11 06:34:27 host2 sshd[531547]: Disconnected from invalid user sftptest 185.106.95.252 port 40080 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.74
country_id: 6252001
description:
Nov 11 06:34:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=199.45.155.74, lip=66.85.158.91, TLS: Connection closed, session=<EtfJO0dDwq7HLZtK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.74
country_id: 6252001
description:
Nov 11 06:34:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.155.74, lip=66.85.158.91, TLS, session=<GPOlPEdDqLrHLZtK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Nov 11 06:35:46 host2 sshd[532295]: Disconnected from invalid user default 52.183.128.237 port 36308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 11 06:35:48 host2 sshd[532312]: Disconnected from invalid user lu 130.107.240.11 port 45104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.106.95.252
country_id: 6252001
description:
Nov 11 06:36:38 host2 sshd[532704]: Disconnected from invalid user sandra 185.106.95.252 port 43368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 11 06:37:06 host2 sshd[532949]: Disconnected from invalid user dict 130.107.240.11 port 53156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 11 06:38:22 host2 sshd[533471]: Disconnected from invalid user ubuntu 130.107.240.11 port 49792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 06:38:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<GgzeSEdDMstD1VIS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 06:44:53 host2 sshd[537186]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 11 06:50:50 host2 sshd[540079]: Disconnected from invalid user amit 107.150.106.178 port 48142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 11 06:51:06 host2 sshd[540214]: Disconnected from invalid user mutua 101.47.51.246 port 42768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 06:54:22 host2 sshd[541973]: Disconnected from invalid user admin 2.57.121.112 port 44157 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 06:55:22 host2 sshd[542925]: Disconnected from invalid user admin 2.57.121.112 port 6465 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.22.160
country_id: 2921044
description:
Nov 11 06:56:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.22.22.160, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OJX3h0dDyFilFhag>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 11 06:59:22 host2 sshd[545082]: Disconnected from invalid user cat 101.47.51.246 port 37688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.204
country_id: 6252001
description:
Nov 11 07:02:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.204, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1DGNnUdDnMPN0h/M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.30
country_id: 953987
description:
Nov 11 07:03:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.64.37.30, lip=66.85.158.91, TLS, session=<4rfKn0dDiclmQCUe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.39
country_id: 2510769
description:
Nov 11 07:03:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=45.135.197.39, lip=66.85.158.91, TLS, session=<YiojoUdDc+0th8Un>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 11 07:05:14 host2 sshd[549044]: Disconnected from invalid user ubuntu 107.150.106.178 port 40088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 11 07:07:18 host2 sshd[550103]: Disconnected from invalid user lee 101.47.51.246 port 56904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 11 07:08:59 host2 sshd[550989]: Disconnected from invalid user admin 107.150.106.178 port 33286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-11 07:11:28 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:47188: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 07:13:27 host2 sshd[553253]: Disconnected from invalid user darian 62.60.131.157 port 41287 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 11 07:13:30 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VnJoxkdDZJtChJmA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 11 07:12:50 host2 sshd[552897]: Disconnected from invalid user staging 107.150.106.178 port 54728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 07:14:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<M8dKyEdDfohD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 11 07:20:04 host2 sshd[556722]: Disconnected from invalid user syp 101.47.51.246 port 51320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 11 07:22:38 host2 sshd[558046]: Disconnected from invalid user test 101.47.51.246 port 46838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.52
country_id: 798549
description:
2025-11-11 07:29:58 dovecot_login authenticator failed for (ADMIN) [143.244.52.52]:13616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 07:33:36 host2 sshd[563308]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.93.165.176
country_id: 3469034
description:
Nov 11 07:40:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=177.93.165.176, lip=66.85.158.91, session=<98F4J0hDbbmxXaWw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.20
country_id: 1269750
description:
Nov 11 07:41:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.18.166.20, lip=66.85.158.91, TLS, session=<I7qaJ0hD2cZnEqYU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-11 07:44:54 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:56536: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.68
country_id: 2750405
description:
2025-11-11 07:48:24 dovecot_login authenticator failed for (ADMIN) [158.173.20.68]:64396: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 07:49:55 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<VsqGSEhDRLRD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.211.101
country_id: 1819730
description:
2025-11-11 08:01:03 dovecot_login authenticator failed for (host-by.00.net) [103.77.211.101]:55153: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.178
country_id: 6252001
description:
Nov 11 08:05:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.178, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<uUk4gUhDS9fG6xiy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 08:06:33 host2 sshd[582310]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.111.67.164
country_id: 2921044
description:
[2025-11-11 08:07:37 +0530] info [cpaneld] 78.111.67.164 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Nov 11 08:10:06 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.43.33.218, lip=66.85.158.91, session=<p4LTkEhD8ZEtKyHa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 08:10:32 host2 sshd[584204]: Disconnected from invalid user user 2.57.121.25 port 43111 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 08:11:56 host2 sshd[584837]: Disconnected from invalid user user 2.57.121.25 port 6613 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.13
country_id: 2635167
description:
Nov 11 08:12:11 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.13, lip=66.85.158.91, TLS, session=<H9xImEhD6cu594kN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 08:12:18 host2 sshd[585105]: Disconnected from invalid user admin 2.57.121.112 port 49578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.150
country_id: 3077311
description:
2025-11-11 08:13:23 dovecot_login authenticator failed for (ADMIN) [212.102.39.150]:55976: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.54
country_id: 6252001
description:
Nov 11 08:18:46 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5PvKr0hDisTN0h82>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 08:25:38 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<Htg/yEhDtt9D1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.71
country_id: 6252001
description:
Nov 11 08:32:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=195.184.76.71, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HQh04khDVZzDuExH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.70
country_id: 6252001
description:
Nov 11 08:33:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.70, lip=66.85.158.92, TLS: Connection closed, session=<0PYQ40hDSYnDuExG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.169
country_id: 6252001
description:
Nov 11 08:33:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.169, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lUF/40hDCdLDuEyp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.66
country_id: 6252001
description:
Nov 11 08:33:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.66, lip=66.85.158.92, TLS: Connection closed, session=<rhOu40hDjYnDuExC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-11 08:34:27 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:45012: 535 Incorrect authentication data (set_id=office@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.59
country_id: 6251999
description:
2025-11-11 08:34:43 dovecot_login authenticator failed for (ADMIN) [66.56.80.59]:30319: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-11 08:36:06 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:48219: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.113
country_id: 3017382
description:
Nov 11 08:39:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.113, lip=66.85.158.92, TLS: Connection closed, session=<4+LG+khDE8dbxJhx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.116
country_id: 3017382
description:
Nov 11 08:40:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.116, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HaHK+0hD+cVbxJh0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.25
country_id: 3017382
description:
Nov 11 08:40:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.25, lip=66.85.158.92, TLS: Connection closed, session=<S8/5+0hD64RbxJgZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Nov 11 08:39:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.31, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Up0h+khDichbxJgf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 08:40:55 host2 sshd[601346]: Disconnected from invalid user jasmyn 62.60.131.157 port 17323 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.116.124
country_id: 6252001
description:
Nov 11 08:44:09 host2 sshd[603189]: Disconnected from invalid user ctarazona 74.48.116.124 port 45296 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.192
country_id: 6252001
description:
Nov 11 08:46:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.150.192, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4vwZFElDmsKi2JbA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.116.124
country_id: 6252001
description:
Nov 11 08:47:09 host2 sshd[606829]: Disconnected from invalid user joshua 74.48.116.124 port 40156 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.192
country_id: 6252001
description:
Nov 11 08:48:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.192, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<Z6adGElDuOGi2JbA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.192
country_id: 6252001
description:
Nov 11 08:48:10 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.192, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<mUr6GElD4uai2JbA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.116.124
country_id: 6252001
description:
Nov 11 08:49:31 host2 sshd[608205]: Disconnected from invalid user vincent 74.48.116.124 port 49186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.152
country_id: 2960313
description:
2025-11-11 08:54:00 dovecot_login authenticator failed for (ADMIN) [37.46.113.152]:50120: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.192
country_id: 6252001
description:
Nov 11 08:54:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.192, lip=66.85.158.92, TLS, session=<8MdLL0lDuOyi2JbA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 08:55:16 host2 sshd[611755]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.210
country_id: 3175395
description:
Nov 11 08:56:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=194.60.212.210, lip=66.85.158.91, TLS, session=<YMYZNUlDKKvCPNTS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.179
country_id: 953987
description:
Nov 11 08:56:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.64.34.179, lip=66.85.158.91, TLS, session=<qXRDNklDzNxmQCKz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 09:01:31 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<zUaTSElDJp1D1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov 11 09:05:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<zqOPVUlDlf7CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 11 09:07:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<LQV2XUlDFpZChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.135.183
country_id: 1327865
description:
Nov 11 09:08:22 host2 sshd[618981]: Disconnected from invalid user admin 103.23.135.183 port 62731 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Nov 11 09:08:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.55, lip=66.85.158.92, TLS: Connection closed, session=<N7McYklDsjunXpI3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.242
country_id: 2077456
description:
2025-11-11 09:12:20 dovecot_login authenticator failed for (ADMIN) [154.16.81.242]:36744: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.135.183
country_id: 1327865
description:
Nov 11 09:15:02 host2 sshd[622359]: Disconnected from invalid user speedtest 103.23.135.183 port 26059 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.135.183
country_id: 1327865
description:
Nov 11 09:17:03 host2 sshd[623824]: Disconnected from invalid user marek 103.23.135.183 port 45161 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.135.183
country_id: 1327865
description:
Nov 11 09:23:41 host2 sshd[627275]: Disconnected from invalid user ansible 103.23.135.183 port 29933 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 11 09:27:16 host2 sshd[629212]: Disconnected from invalid user cie 79.59.175.196 port 52842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.213
country_id: 6252001
description:
Nov 11 09:33:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.213, lip=66.85.158.92, TLS, session=<LgmTuUlDaPbN0h/V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 09:36:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<kCTlxUlDzMdD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 11 09:38:51 host2 sshd[635189]: Disconnected from invalid user daniel 79.59.175.196 port 44830 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.129
country_id: 6252001
description:
Nov 11 09:39:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.129, lip=66.85.158.91, session=<3YKJz0lDIu+TuYSB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 11 09:40:18 host2 sshd[636008]: Disconnected from invalid user postgres 79.59.175.196 port 49346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.39
country_id: 1880251
description:
Nov 11 09:40:47 host2 sshd[636178]: Disconnected from invalid user jenkins 45.78.227.39 port 55946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.39
country_id: 1880251
description:
Nov 11 09:43:50 host2 sshd[637877]: Disconnected from invalid user root1 45.78.227.39 port 41572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 11 09:44:30 host2 sshd[638771]: Disconnected from invalid user jmarquez 79.59.175.196 port 34672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.227.39
country_id: 1880251
description:
Nov 11 09:46:37 host2 sshd[640042]: Disconnected from invalid user tv 45.78.227.39 port 36716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.22
country_id: 1880251
description:
Nov 11 09:47:26 host2 sshd[640549]: Disconnected from invalid user administrator1 101.47.142.22 port 49764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.25
country_id: 3042058
description:
2025-11-11 09:47:33 dovecot_login authenticator failed for (ADMIN) [91.90.122.25]:50334: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-11 09:48:55 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53535: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.164.81
country_id: 798544
description:
Nov 11 09:51:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.232.164.81, lip=66.85.158.91, TLS, session=<nfgy+0lDZcpb6KRR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 09:51:47 host2 sshd[643018]: Disconnected from invalid user user 2.57.121.25 port 11095 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.224
country_id: 3469034
description:
Nov 11 09:52:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.255.206.224, lip=66.85.158.91, TLS, session=<F3Jq/ElDyZuK/87g>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.210.16
country_id: 2921044
description:
Nov 11 09:55:47 host2 sshd[645483]: Disconnected from invalid user irfan 68.183.210.16 port 60560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.210.16
country_id: 2921044
description:
Nov 11 09:59:31 host2 sshd[647659]: Disconnected from invalid user admin 68.183.210.16 port 53584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 11 10:00:50 host2 sshd[648584]: Disconnected from invalid user irfan 200.118.99.170 port 56010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.22
country_id: 1880251
description:
Nov 11 10:00:56 host2 sshd[648616]: Disconnected from invalid user mark 101.47.142.22 port 48218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.210.16
country_id: 2921044
description:
Nov 11 10:03:06 host2 sshd[649939]: Disconnected from invalid user hausadel 68.183.210.16 port 60622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.217
country_id: 6251999
description:
2025-11-11 10:04:22 dovecot_login authenticator failed for (ADMIN) [66.56.80.217]:40390: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 11 10:04:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.7, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pFY+KkpDKPmi2JUH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.22
country_id: 1880251
description:
Nov 11 10:06:16 host2 sshd[652363]: Disconnected from invalid user speedtest 101.47.142.22 port 56332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 11 10:07:16 host2 sshd[652939]: Disconnected from invalid user admin 200.118.99.170 port 55306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.210.16
country_id: 2921044
description:
Nov 11 10:07:38 host2 sshd[653064]: Disconnected from invalid user mac 68.183.210.16 port 45632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 11 10:09:38 host2 sshd[654097]: Disconnected from invalid user nikola 200.118.99.170 port 55012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 11 10:09:42 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.7, lip=66.85.158.91, TLS, session=<Rj2CPEpD9Oyi2JUH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 10:11:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<5sOpQ0pDioND1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 11 10:12:09 host2 sshd[655721]: Disconnected from invalid user ftptest 200.118.99.170 port 54728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.22
country_id: 1880251
description:
Nov 11 10:14:14 host2 sshd[657286]: Disconnected from invalid user jy 101.47.142.22 port 39624 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.227.103.150
country_id: 2921044
description:
[2025-11-11 10:26:16 +0530] info [cpaneld] 212.227.103.150 - admin "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 11 10:34:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<2xVVlUpDi//CpRCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Nov 11 10:36:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, session=<AJ25mkpD7lNAPsXF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Nov 11 10:36:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, TLS: Connection closed, session=<8c6Um0pDqhpAPsXF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 10:44:48 host2 sshd[677749]: Disconnected from invalid user admin 2.57.121.112 port 58810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.221
country_id: 6252001
description:
2025-11-11 10:44:53 dovecot_login authenticator failed for (ADMIN) [102.129.234.221]:55636: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 10:47:06 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<+sstwkpDdK1D1VIS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.209
country_id: 3469034
description:
Nov 11 10:47:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=191.53.131.209, lip=66.85.158.91, TLS, session=<TQC+wUpDMt2/NYPR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.22
country_id: 690791
description:
Nov 11 10:47:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.22, lip=66.85.158.91, TLS, session=<8dvnwkpDROTCLIwW>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.12.204.239
country_id: 2960313
description:
Nov 11 10:56:12 host2 sshd[684007]: User bostonlanka from 185.12.204.239 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.158.222
country_id: 2750405
description:
[2025-11-11 11:07:57 +0530] info [webmaild] 45.80.158.222 - roundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user roundcube (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.159
country_id: 798549
description:
2025-11-11 11:10:31 dovecot_login authenticator failed for (ADMIN) [91.90.120.159]:38107: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-11 11:16:49 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:39454: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 11 11:22:03 host2 sshd[698083]: Disconnected from invalid user ubuntu 24.232.50.5 port 57492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.187
country_id: 1880251
description:
Nov 11 11:21:14 host2 sshd[697730]: Disconnected from invalid user csgoserver 45.78.206.187 port 35330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 11:22:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<cWhAQUtDFtdD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Nov 11 11:24:34 host2 sshd[699256]: Disconnected from invalid user admin 190.119.63.98 port 18792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Nov 11 11:26:05 host2 sshd[700162]: Disconnected from invalid user student2 190.119.63.98 port 26205 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.69
country_id: 6252001
description:
Nov 11 11:25:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.69, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4CWTSktDWd7N0h9F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 11 11:26:30 host2 sshd[700349]: Disconnected from invalid user hdd 24.232.50.5 port 60552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-11 11:27:45 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:58262: 535 Incorrect authentication data (set_id=news@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-11 11:28:01 dovecot_login authenticator failed for (nsg-corporate-150.144.185.122.airtel.in) [122.185.144.150]:40160: 535 Incorrect authentication data (set_id=news)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.63.98
country_id: 3932488
description:
Nov 11 11:27:36 host2 sshd[700911]: Disconnected from invalid user reno 190.119.63.98 port 29099 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.173
country_id: 1880251
description:
Nov 11 11:29:15 host2 sshd[701980]: Disconnected from invalid user postgres 101.47.163.173 port 51778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Nov 11 11:30:31 host2 sshd[702894]: Disconnected from invalid user server 190.119.63.98 port 23846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.253.20
country_id: 2077456
description:
Nov 11 11:30:15 host2 sshd[702641]: Disconnected from invalid user vr 115.129.253.20 port 46933 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 11 11:31:11 host2 sshd[703223]: Disconnected from invalid user vikas 24.232.50.5 port 34540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 11:33:16 host2 sshd[704226]: Disconnected from invalid user katia 62.60.131.157 port 27791 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 11:33:32 host2 sshd[704347]: Disconnected from invalid user user 2.57.121.25 port 11983 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.33
country_id: 1814991
description:
2025-11-11 11:36:05 dovecot_login authenticator failed for (ADMIN) [188.241.80.33]:40160: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 11 11:35:49 host2 sshd[705677]: Disconnected from invalid user rakesh 24.232.50.5 port 43944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.187
country_id: 1880251
description:
Nov 11 11:41:30 host2 sshd[708563]: Disconnected from invalid user server 45.78.206.187 port 46320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.206.187
country_id: 1880251
description:
Nov 11 11:44:13 host2 sshd[710058]: Disconnected from invalid user steam 45.78.206.187 port 53046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.110
country_id: 690791
description:
Nov 11 11:46:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.6.110, lip=66.85.158.91, TLS, session=<3UlOlEtDbKqwZwZu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.65
country_id: 3469034
description:
Nov 11 11:45:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=191.240.96.65, lip=66.85.158.91, TLS, session=<Ap8Vk0tDObu/8GBB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.253.20
country_id: 2077456
description:
Nov 11 11:48:39 host2 sshd[712547]: Disconnected from invalid user deleteme 115.129.253.20 port 34227 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Nov 11 11:50:00 host2 sshd[713196]: Disconnected from invalid user caja01 34.92.81.41 port 38258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.253.20
country_id: 2077456
description:
Nov 11 11:52:42 host2 sshd[714930]: Disconnected from invalid user r00t 115.129.253.20 port 34845 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Nov 11 11:53:09 host2 sshd[715205]: Disconnected from invalid user ubuntu 34.92.81.41 port 46852 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Nov 11 11:56:08 host2 sshd[718017]: Disconnected from invalid user chromeuser 34.92.81.41 port 54408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Nov 11 11:57:32 host2 sshd[718795]: Disconnected from invalid user sonu 34.92.81.41 port 58180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.253.20
country_id: 2077456
description:
Nov 11 11:57:05 host2 sshd[718558]: Disconnected from invalid user adam 115.129.253.20 port 34862 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.158.222
country_id: 2750405
description:
[2025-11-11 11:57:12 +0530] info [webmaild] 45.80.158.222 - roundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user roundcube (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 11:58:27 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<l6BUwUtDoJJD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.42
country_id: 798549
description:
2025-11-11 12:00:25 dovecot_login authenticator failed for (ADMIN) [143.244.52.42]:59493: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Nov 11 12:06:24 host2 sshd[723967]: Disconnected from invalid user baba 34.92.81.41 port 52726 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 12:15:48 host2 sshd[729334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 11 12:15:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<sk6g/0tDqskDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.220.163.89
country_id: 2661886
description:
Nov 11 12:17:20 host2 sshd[730030]: Disconnecting invalid user admin 62.220.163.89 port 41816: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 11 12:17:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<+DFfBUxDqLoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.179
country_id: 3017382
description:
2025-11-11 12:17:48 dovecot_login authenticator failed for (ADMIN) [156.146.63.179]:29808: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.220.163.89
country_id: 2661886
description:
Nov 11 12:17:06 host2 sshd[729914]: Disconnecting authenticating user root 62.220.163.89 port 46932: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.220.163.89
country_id: 2661886
description:
Nov 11 12:17:06 host2 sshd[729914]: error: maximum authentication attempts exceeded for root from 62.220.163.89 port 46932 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.220.163.89
country_id: 2661886
description:
Nov 11 12:17:16 host2 sshd[730009]: error: maximum authentication attempts exceeded for invalid user admin from 62.220.163.89 port 41814 ssh2 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 11 12:20:03 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<PKO0DkxD7JUDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 11 12:21:31 host2 dovecot[43647]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<x7/rE0xDfuwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 11 12:21:30 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<1zzmE0xDeuwDgmBb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.217
country_id: 2635167
description:
Nov 11 12:24:55 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.217, lip=66.85.158.91, TLS, session=<KPEVIExDEbNX7LDZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.116
country_id: 2635167
description:
Nov 11 12:24:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.116, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</SwsIExDu9hX7LB0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 11 12:24:09 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<fvhgHUxDprQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.140
country_id: 2635167
description:
Nov 11 12:25:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.140, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IJQnIkxDQcW594mM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.131
country_id: 2635167
description:
Nov 11 12:26:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.131, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h4AeJkxDeYNX7LCD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.128
country_id: 2635167
description:
Nov 11 12:26:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.128, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<+iMjJExDObW594mA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.132
country_id: 2635167
description:
Nov 11 12:27:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.132, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<JvwZKExDF7K594mE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.124
country_id: 2635167
description:
Nov 11 12:27:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.124, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VHQTKkxDM6i594l8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.118
country_id: 2635167
description:
Nov 11 12:28:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.118, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ouMQLExDN6FX7LB2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.140
country_id: 2635167
description:
Nov 11 12:28:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.140, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<I2wMLkxDm4K594mM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.131
country_id: 2635167
description:
Nov 11 12:29:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.131, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<KtUFMExDYaZX7LCD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.111
country_id: 2635167
description:
Nov 11 12:29:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<2kYBMkxDG8W594lv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Nov 11 12:31:38 host2 sshd[738388]: Disconnected from invalid user keith 206.81.27.245 port 49474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 12:34:31 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<Uv9LQkxDhrxD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.9
country_id: 3996063
description:
2025-11-11 12:37:38 dovecot_login authenticator failed for (ADMIN) [77.81.142.9]:22167: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.93.207
country_id: 2963597
description:
Nov 11 12:42:21 host2 sshd[744613]: Disconnected from invalid user ghost 20.123.93.207 port 18657 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.55
country_id: 1880251
description:
Nov 11 12:42:22 host2 sshd[744600]: Disconnected from invalid user ghost 101.47.142.55 port 37276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.93
country_id: 1880251
description:
Nov 11 12:43:34 host2 sshd[745208]: Disconnected from invalid user nftp 101.47.163.93 port 60242 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.55
country_id: 6252001
description:
Nov 11 12:45:33 host2 pure-ftpd[747114]: (?@147.185.132.55) [INFO] New connection from 147.185.132.55


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.13.24.118
country_id: 3865483
description:
Nov 11 12:45:16 host2 sshd[746756]: Disconnected from invalid user antony 186.13.24.118 port 44100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.81.27.245
country_id: 2921044
description:
Nov 11 12:45:20 host2 sshd[747003]: Disconnected from invalid user sly 206.81.27.245 port 54962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Nov 11 12:46:48 host2 sshd[747661]: Disconnected from invalid user jon 212.233.136.201 port 37296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.93.207
country_id: 2963597
description:
Nov 11 12:46:24 host2 sshd[747491]: Disconnected from invalid user mongod 20.123.93.207 port 38879 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.55
country_id: 1880251
description:
Nov 11 12:47:30 host2 sshd[748029]: Disconnected from invalid user laravel 101.47.142.55 port 55948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.93
country_id: 1880251
description:
Nov 11 12:48:43 host2 sshd[748728]: Disconnected from invalid user qi 101.47.163.93 port 34514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.3.42
country_id: 2215636
description:
Nov 11 12:49:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=5.63.3.42, lip=66.85.158.91, TLS, session=<Iz8JdkxDn4EFPwMq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Nov 11 12:49:16 host2 sshd[749050]: Disconnected from invalid user root1 206.81.27.245 port 44808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.7
country_id: 3175395
description:
Nov 11 12:49:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.208.188.7, lip=66.85.158.91, TLS, session=<V2AYd0xDrZm50LwH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.13.24.118
country_id: 3865483
description:
Nov 11 12:50:05 host2 sshd[749564]: Disconnected from invalid user supplier 186.13.24.118 port 48008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.13.24.118
country_id: 3865483
description:
Nov 11 12:51:40 host2 sshd[750348]: Disconnected from invalid user dev1 186.13.24.118 port 34918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Nov 11 12:51:14 host2 sshd[750195]: Disconnected from invalid user tom 206.81.27.245 port 47732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.55
country_id: 1880251
description:
Nov 11 12:52:40 host2 sshd[750754]: Disconnected from invalid user entrega 101.47.142.55 port 55030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.50
country_id: 1880251
description:
Nov 11 12:52:46 host2 sshd[750775]: Disconnected from invalid user hadoop 101.47.49.50 port 42612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Nov 11 12:56:48 host2 sshd[754037]: Disconnected from invalid user admin 212.233.136.201 port 44948 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 12:56:59 host2 sshd[754142]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.23
country_id: 2963597
description:
2025-11-11 12:59:21 dovecot_login authenticator failed for (ADMIN) [155.2.194.23]:44044: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.53.197
country_id: 2802361
description:
Nov 11 13:05:19 host2 pure-ftpd[759461]: (?@130.211.53.197) [INFO] New connection from 130.211.53.197


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.163.93
country_id: 1880251
description:
Nov 11 13:06:14 host2 sshd[759844]: Disconnected from invalid user user 101.47.163.93 port 38306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-11-11 13:06:49 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:55833: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-11-11 13:06:51 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:56559: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-11 13:07:09 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:56249: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-11 13:07:14 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:53474: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 13:10:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<PR9Mw0xDeuZD1VIS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 11 13:13:55 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<SYJVz0xDsP7CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-11 13:13:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52447: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 13:15:47 host2 sshd[764930]: Disconnected from invalid user admin 2.57.121.112 port 7785 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.183.177
country_id: 6252001
description:
Nov 11 13:16:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.183.177, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zldx10xDcKgofLex>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.73
country_id: 3017382
description:
2025-11-11 13:23:00 dovecot_login authenticator failed for (ADMIN) [203.188.183.73]:41211: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.50
country_id: 1880251
description:
Nov 11 13:27:47 host2 sshd[770857]: Disconnected from invalid user tmpuser 101.47.49.50 port 43678 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.40
country_id: 6252001
description:
Nov 11 13:28:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.40, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0ZolBE1DTN/N0h8o>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.49.50
country_id: 1880251
description:
Nov 11 13:30:20 host2 sshd[772623]: Disconnected from invalid user vhserver 101.47.49.50 port 42860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-11 13:36:49 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:37844: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-11 13:37:05 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:41330: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.73.238
country_id: 6252001
description:
Nov 11 13:42:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.73.238, lip=66.85.158.91, TLS, session=<ty5wNk1DtOwUDknu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-11 13:43:52 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:54170: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.52
country_id: 99237
description:
2025-11-11 13:44:08 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:40150: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-11 13:44:09 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:54457: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2025-11-11 13:44:37 dovecot_login authenticator failed for ([197.251.249.79]) [197.251.249.79]:46649: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 13:46:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<6HDgRE1DGKJD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.130
country_id: 1210997
description:
2025-11-11 13:48:36 dovecot_login authenticator failed for (ADMIN) [64.64.112.130]:48570: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 13:51:31 host2 sshd[785013]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 11 13:57:37 host2 pure-ftpd[789430]: (?@51.222.152.150) [INFO] New connection from 51.222.152.150


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 11 13:57:43 host2 pure-ftpd[789471]: (?@51.222.152.150) [INFO] New connection from 51.222.152.150


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 174.138.93.235
country_id: 6252001
description:
Nov 11 13:58:00 host2 pure-ftpd[789647]: (?@174.138.93.235) [INFO] New connection from 174.138.93.235


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.173
country_id: 99237
description:
Nov 11 14:03:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=65.20.137.173, lip=66.85.158.91, TLS, session=<+GaJgE1Do7xBFImt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.200
country_id: 1269750
description:
Nov 11 14:04:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.118.34.200, lip=66.85.158.91, TLS, session=<KdfBgU1DTNAtdiLI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.235.48
country_id: 6251999
description:
Nov 11 14:12:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.235.48, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<3nVin01DWK+lFusw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.121
country_id: 6251999
description:
2025-11-11 14:12:58 dovecot_login authenticator failed for (ADMIN) [66.56.81.121]:65343: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.146.204
country_id: 6252001
description:
[2025-11-11 14:17:09 +0530] info [cpaneld] 146.190.146.204 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 14:23:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<qp0Wx01D1MtD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-11-11 14:25:40 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:55108: 535 Incorrect authentication data (set_id=partners@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.254.24
country_id: 1880251
description:
Nov 11 14:26:10 host2 sshd[809010]: Disconnected from invalid user testuser 139.59.254.24 port 49436 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 11 14:27:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<fUQg1k1DvqKLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.254.24
country_id: 1880251
description:
Nov 11 14:29:45 host2 sshd[811307]: Disconnected from invalid user mohammad 139.59.254.24 port 55932 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 14:32:30 host2 sshd[813140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.254.24
country_id: 1880251
description:
Nov 11 14:32:38 host2 sshd[813302]: Disconnected from invalid user oracle 139.59.254.24 port 50148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.254.24
country_id: 1880251
description:
Nov 11 14:35:13 host2 sshd[814852]: Disconnected from invalid user andrey 139.59.254.24 port 49596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Nov 11 14:34:52 host2 sshd[814422]: Disconnected from invalid user abc 103.31.39.143 port 48428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.55.205.184
country_id: 6252001
description:
Nov 11 14:34:55 host2 sshd[814446]: Disconnected from invalid user deluge 38.55.205.184 port 52142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.238
country_id: 718075
description:
2025-11-11 14:36:26 dovecot_login authenticator failed for (ADMIN) [185.225.28.238]:3645: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.39.143
country_id: 1643084
description:
Nov 11 14:36:59 host2 sshd[815896]: Disconnected from invalid user ajarami 103.31.39.143 port 60554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.55.205.184
country_id: 6252001
description:
Nov 11 14:37:05 host2 sshd[815978]: Disconnected from invalid user abc 38.55.205.184 port 49364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 11 14:38:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<sdgY/01DNstChJl2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.55.205.184
country_id: 6252001
description:
Nov 11 14:39:16 host2 sshd[817337]: Disconnected from invalid user mikrotik 38.55.205.184 port 38208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.228
country_id: 6251999
description:
Nov 11 14:42:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.210.228, lip=66.85.158.92, session=<KSE8DE5Dct+UcdLk>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.55.205.184
country_id: 6252001
description:
Nov 11 14:45:11 host2 sshd[821504]: Disconnected from invalid user toni 38.55.205.184 port 46214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.97
country_id: 6252001
description:
Nov 11 14:47:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.97, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HVJwHE5DZYDDuExh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.99
country_id: 6252001
description:
Nov 11 14:47:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=195.184.76.99, lip=66.85.158.92, TLS: Connection closed, session=<KUEaHU5DO5LDuExj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.96
country_id: 6252001
description:
Nov 11 14:47:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.96, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ENSBHU5DEdTDuExg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.120
country_id: 6252001
description:
Nov 11 14:47:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.120, lip=66.85.158.92, TLS: Connection closed, session=<zd2wHU5DQYLDuEx4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 11 14:56:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<pLFvP05D7v/CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.110
country_id: 3017382
description:
Nov 11 14:58:36 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.110, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vui8RU5DtbhbxJhu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.106
country_id: 3017382
description:
Nov 11 14:58:47 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.106, lip=66.85.158.92, TLS: Connection closed, session=<jM5cRk5D9+1bxJhq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.22
country_id: 3017382
description:
Nov 11 14:59:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.22, lip=66.85.158.92, TLS: Connection closed, session=<4shVR05DnbFbxJgW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.241.108.225
country_id: 6252001
description:
Nov 11 14:59:12 host2 sshd[831294]: Invalid user cloudtourssrilan_travel from 151.241.108.225 port 65487


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.111
country_id: 3017382
description:
Nov 11 14:59:00 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.111, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EKUlR05DD8pbxJhv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.241.108.225
country_id: 6252001
description:
Nov 11 14:59:53 host2 sshd[831633]: Invalid user cloudtourssrilan_travel from 151.241.108.225 port 52169


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 15:00:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<8ivGSk5DVodD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.80
country_id: 2635167
description:
2025-11-11 15:00:44 dovecot_login authenticator failed for (ADMIN) [98.159.234.80]:9051: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Nov 11 15:02:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<qhhZU05D7pLJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.100
country_id: 953987
description:
Nov 11 15:03:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.43.100, lip=66.85.158.91, TLS, session=<VrmGVE5DvNtmQCtk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-11 15:12:24 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:60483: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.159.9
country_id: 6251999
description:
Nov 11 15:19:05 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=138.197.159.9, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<sXL7jk5DzM2KxZ8J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.114.53
country_id: 3374766
description:
2025-11-11 15:20:47 dovecot_login authenticator failed for ([127.0.0.1]) [165.90.114.53]:49793: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2025-11-11 15:21:02 dovecot_login authenticator failed for ([127.0.0.1]) [49.124.149.199]:40132: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Nov 11 15:22:17 host2 sshd[845830]: Disconnected from invalid user up 186.38.26.5 port 50456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.55.36.22
country_id: 1643084
description:
Nov 11 15:22:59 host2 sshd[846228]: Disconnected from invalid user user1 103.55.36.22 port 54718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Nov 11 15:24:07 host2 sshd[846775]: Disconnected from invalid user dd 186.38.26.5 port 54288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.40
country_id: 798544
description:
2025-11-11 15:25:00 dovecot_login authenticator failed for (ADMIN) [138.199.59.40]:53620: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Nov 11 15:25:03 host2 sshd[847119]: Disconnected from invalid user remoto 103.55.36.22 port 36276 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 15:26:55 host2 sshd[848831]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-11-11 15:27:39 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:35882: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-11 15:28:01 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:46100: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.221
country_id: 6252001
description:
Nov 11 15:29:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.221, lip=66.85.158.91, TLS, session=<m1grtE5DJuPG6xjd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.38.26.5
country_id: 3865483
description:
Nov 11 15:31:12 host2 sshd[851317]: Disconnected from invalid user frappe 186.38.26.5 port 41398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-11 15:32:10 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:65103: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.211.9.236
country_id: 2921044
description:
[2025-11-11 15:35:17 +0530] info [cpaneld] 82.211.9.236 - kamechot "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 15:37:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<baX8zk5DYLFD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-11 15:40:26 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:58385: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 11 15:44:12 host2 sshd[858391]: Disconnected from invalid user acs 103.252.118.164 port 58176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.243
country_id: 1880251
description:
Nov 11 15:46:21 host2 sshd[860142]: Disconnected from invalid user alex 45.78.206.243 port 34904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.206.243
country_id: 1880251
description:
Nov 11 15:48:58 host2 sshd[861196]: Disconnected from invalid user ts3 45.78.206.243 port 46302 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.126.21
country_id: 6252001
description:
Nov 11 15:50:27 host2 pure-ftpd[862056]: (?@130.211.126.21) [INFO] New connection from 130.211.126.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-11 15:50:38 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:38792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 15:51:15 host2 sshd[862388]: Disconnected from invalid user mackenzie 62.60.131.157 port 60724 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 15:52:31 host2 sshd[862983]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.243
country_id: 1880251
description:
Nov 11 16:01:33 host2 sshd[868863]: Disconnected from invalid user dut 45.78.206.243 port 51904 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 11 16:02:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<V9TRK09D9tlChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 11 16:06:22 host2 sshd[872403]: Disconnected from invalid user sajjad 51.75.27.166 port 55050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 11 16:07:37 host2 sshd[872964]: Disconnected from invalid user sigit 51.75.27.166 port 59934 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 16:08:00 host2 sshd[873169]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.150
country_id: 3041565
description:
2025-11-11 16:08:19 dovecot_login authenticator failed for (ADMIN) [173.239.217.150]:57820: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 11 16:09:24 host2 sshd[873950]: Disconnected from invalid user user8 103.252.118.164 port 32154 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 11 16:08:50 host2 sshd[873684]: Disconnected from invalid user bot 51.75.27.166 port 44706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.224.235
country_id: 798549
description:
Nov 11 16:11:24 host2 sshd[875272]: Disconnected from invalid user test 45.135.224.235 port 32858 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.76.108.97
country_id: 953987
description:
[2025-11-11 16:12:24 +0530] info [cpaneld] 41.76.108.97 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 11 16:12:41 host2 sshd[875832]: Disconnected from invalid user zero 51.75.27.166 port 36378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 16:14:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<TCRzVU9DPttD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Nov 11 16:14:50 host2 sshd[877785]: Disconnected from invalid user ander 34.124.148.87 port 34350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.148
country_id: 1733045
description:
2025-11-11 16:16:03 dovecot_login authenticator failed for ([49.124.152.148]) [49.124.152.148]:44796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.94
country_id: 1269750
description:
2025-11-11 16:16:36 dovecot_login authenticator failed for ([128.185.223.214]) [27.123.111.94]:37310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.224.235
country_id: 798549
description:
Nov 11 16:17:20 host2 sshd[879169]: Disconnected from invalid user hero 45.135.224.235 port 44728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Nov 11 16:17:24 host2 sshd[879183]: Disconnected from invalid user zyx 34.124.148.87 port 35134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.135.224.235
country_id: 798549
description:
Nov 11 16:18:30 host2 sshd[879633]: Disconnected from invalid user user 45.135.224.235 port 45222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 11 16:19:05 host2 sshd[879973]: Disconnected from invalid user steam 51.75.27.166 port 43538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 11 16:18:11 host2 sshd[879492]: Disconnected from invalid user zs 34.69.0.72 port 46612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 11 16:19:31 host2 sshd[880188]: Disconnected from invalid user hero 34.69.0.72 port 53344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 11 16:20:50 host2 sshd[880928]: Disconnected from invalid user srvadmin 34.69.0.72 port 60116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.67.245
country_id: 3469034
description:
Nov 11 16:23:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=177.72.67.245, lip=66.85.158.91, TLS, session=<KhANdU9DVumxSEP1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 11 16:23:26 host2 sshd[882037]: Disconnected from invalid user sendmail 34.69.0.72 port 41876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.224.235
country_id: 798549
description:
Nov 11 16:24:27 host2 sshd[882631]: Disconnected from invalid user lzq 45.135.224.235 port 47704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Nov 11 16:25:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.208, lip=66.85.158.92, TLS, session=<8pAWe09DxPzG6xjQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.241.243.10
country_id: 1269750
description:
Nov 11 16:24:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.241.243.10, lip=66.85.158.91, TLS, session=<ZDtodk9D6tFn8fMK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-11-11 16:24:21 +0530] info [cpaneld] 34.27.42.6 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.224.235
country_id: 798549
description:
Nov 11 16:25:39 host2 sshd[883324]: Disconnected from invalid user mostafa 45.135.224.235 port 48194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Nov 11 16:27:39 host2 sshd[884375]: Disconnected from invalid user ftpuser2 34.124.148.87 port 51956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 16:27:50 host2 sshd[884477]: Disconnected from invalid user user 2.57.121.25 port 9530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 16:29:10 host2 sshd[885453]: Disconnected from invalid user user 2.57.121.25 port 12853 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.190
country_id: 6252001
description:
2025-11-11 16:31:40 dovecot_login authenticator failed for (ADMIN) [102.129.234.190]:57290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.224
country_id: 6252001
description:
Nov 11 16:32:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.224, lip=66.85.158.91, session=<333mk09D2yNAPsXg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.212
country_id: 6252001
description:
Nov 11 16:32:16 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.212, lip=66.85.158.91, TLS: Connection closed, session=<6H2xlE9DftxAPsXU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 11 16:41:18 host2 sshd[892638]: Disconnected from invalid user elearn 144.48.8.10 port 51916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 11 16:43:35 host2 sshd[893821]: Disconnected from invalid user Daniel 144.48.8.10 port 50644 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.253.246.22
country_id: 6252001
description:
[2025-11-11 16:45:26 +0530] info [webmaild] 47.253.246.22 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.103
country_id: 6251999
description:
2025-11-11 16:49:10 dovecot_login authenticator failed for (ADMIN) [66.56.80.103]:54282: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-11 16:50:53 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56115: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 16:52:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<OYgz209DqpZD1VIS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.46
country_id: 6252001
description:
Nov 11 16:57:02 host2 pure-ftpd[902106]: (?@172.202.118.46) [INFO] New connection from 172.202.118.46


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.24
country_id: 6252001
description:
Nov 11 16:57:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.24, lip=66.85.158.92, session=<Q++U8E9DVOLG6xgY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.91
country_id: 1880251
description:
Nov 11 16:59:25 host2 sshd[903543]: Disconnected from invalid user kkk 101.47.162.91 port 33396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov 11 17:01:24 host2 sshd[904756]: Disconnected from invalid user kkk 101.100.194.199 port 54628 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 17:02:38 host2 sshd[905280]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov 11 17:03:27 host2 sshd[906011]: Disconnected from invalid user alpha 20.109.73.208 port 33168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 11 17:03:40 host2 sshd[906132]: Disconnected from invalid user ida 213.6.203.226 port 48532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov 11 17:04:11 host2 sshd[906392]: Disconnected from invalid user ida 101.100.194.199 port 36948 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.164.46
country_id: 6252001
description:
Nov 11 17:04:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.98.164.46, lip=66.85.158.92, session=<2+M6CFBDTocUYqQu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 11 17:05:02 host2 sshd[906914]: Disconnected from invalid user nexus 213.6.203.226 port 44548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.91
country_id: 1880251
description:
Nov 11 17:05:42 host2 sshd[907414]: Disconnected from invalid user raju 101.47.162.91 port 54496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-11 17:06:38 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:40525: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-11 17:06:45 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:51248: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-11 17:07:04 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:53869: 535 Incorrect authentication data (set_id=media@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 11 17:08:40 host2 sshd[908768]: Disconnected from invalid user denis 213.6.203.226 port 49894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.131
country_id: 3077311
description:
2025-11-11 17:08:48 dovecot_login authenticator failed for (ADMIN) [212.102.39.131]:35436: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 11 17:09:51 host2 sshd[909438]: Disconnected from invalid user hyodol 213.6.203.226 port 33388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov 11 17:14:57 host2 sshd[913364]: Disconnected from invalid user postgres 101.100.194.199 port 41548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.109.73.208
country_id: 6252001
description:
Nov 11 17:15:27 host2 sshd[913820]: Disconnected from invalid user stack 20.109.73.208 port 42976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.195.73.57
country_id: 3469034
description:
Nov 11 17:15:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=168.195.73.57, lip=66.85.158.91, TLS, session=<zy14L1BD0Zeow0k5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.107
country_id: 798544
description:
Nov 11 17:16:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=212.59.224.107, lip=66.85.158.91, TLS, session=<D6KnMFBDzoLUO+Br>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov 11 17:16:21 host2 sshd[914358]: Disconnected from invalid user testuser 101.100.194.199 port 57296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov 11 17:16:49 host2 sshd[914610]: Disconnected from invalid user orca 20.109.73.208 port 34640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.100.194.199
country_id: 1880251
description:
Nov 11 17:17:47 host2 sshd[915236]: Disconnected from invalid user nexus 101.100.194.199 port 41074 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.92.120
country_id: 2635167
description:
Nov 11 17:18:52 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.65.92.120, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<aCJeO1BDyLafQVx4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.91
country_id: 1880251
description:
Nov 11 17:24:18 host2 sshd[919706]: Disconnected from invalid user testuser 101.47.162.91 port 46882 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.219.131
country_id: 6252001
description:
Nov 11 17:24:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.65.219.131, lip=66.85.158.91, session=<bx8OT1BDPNUUQduD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 17:29:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<gED9YFBDdMBD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.168
country_id: 798549
description:
2025-11-11 17:31:29 dovecot_login authenticator failed for (ADMIN) [91.90.120.168]:28768: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.91
country_id: 1880251
description:
Nov 11 17:32:15 host2 sshd[924539]: Disconnected from invalid user denis 101.47.162.91 port 58838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 17:39:37 host2 sshd[928815]: Disconnected from invalid user admin 2.57.121.112 port 50163 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 17:44:04 host2 sshd[932011]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.91
country_id: 1880251
description:
Nov 11 18:01:36 host2 sshd[944727]: Disconnected from invalid user jerry 101.47.162.91 port 48822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.91
country_id: 1880251
description:
Nov 11 18:06:57 host2 sshd[948355]: Disconnected from invalid user nexus 101.47.162.91 port 46984 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 18:07:09 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<flPh51BDMupD1VIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-11 18:07:25 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:50094: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.99.116
country_id: 1655842
description:
2025-11-11 18:07:51 dovecot_login authenticator failed for ([115.84.99.116]) [115.84.99.116]:60198: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.202
country_id: 6252001
description:
2025-11-11 18:16:02 dovecot_login authenticator failed for (ADMIN) [181.214.166.202]:50218: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 11 18:17:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS: Connection closed, session=<II2DDFFD+DFChJmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.199
country_id: 3077311
description:
2025-11-11 18:36:45 dovecot_login authenticator failed for (ADMIN) [212.102.39.199]:10131: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 18:39:10 host2 sshd[966363]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 18:39:08 host2 sshd[966342]: Disconnected from invalid user ayla 62.60.131.157 port 29349 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 18:40:18 host2 sshd[967145]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.123.49
country_id: 6251999
description:
Nov 11 18:40:30 host2 sshd[967284]: Disconnected from invalid user sebastian 15.235.123.49 port 39884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.123.49
country_id: 6251999
description:
Nov 11 18:41:53 host2 sshd[967928]: Disconnected from invalid user gespinoza 15.235.123.49 port 49628 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.75
country_id: 6252001
description:
Nov 11 18:44:40 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=199.45.155.75, lip=66.85.158.91, session=<QNYtblFDGNLHLZtL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 18:45:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<QhZlb1FDmKVD1VIS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.123.49
country_id: 6251999
description:
Nov 11 18:45:27 host2 sshd[970472]: Disconnected from invalid user lighthouse 15.235.123.49 port 44922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.123.49
country_id: 6251999
description:
Nov 11 18:47:47 host2 sshd[971480]: Disconnected from invalid user operador 15.235.123.49 port 51182 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.175.243
country_id: 6252001
description:
[2025-11-11 18:47:55 +0530] info [cpaneld] 157.245.175.243 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a02:c207:2280:7050::1
country_id: 3017382
description:
[2025-11-11 18:50:06 +0530] info [cpaneld] 2a02:c207:2280:7050::1 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.221
country_id: 6252001
description:
Nov 11 18:56:35 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=</vfKmFFD+psSYRPd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.126
country_id: 3996063
description:
2025-11-11 18:57:29 dovecot_login authenticator failed for (ADMIN) [77.81.142.126]:25831: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.203
country_id: 1880251
description:
Nov 11 19:01:04 host2 sshd[979818]: Disconnected from invalid user ryan 101.47.50.203 port 54130 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.169
country_id: 6252001
description:
Nov 11 19:03:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.208.169, lip=66.85.158.91, session=<lZHzr1FD0pKYINCp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.208.169
country_id: 6252001
description:
Nov 11 19:03:04 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.208.169, lip=66.85.158.91, TLS, session=<0eX5r1FDUpOYINCp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 11 19:04:37 host2 sshd[981722]: Disconnected from invalid user vahid 45.78.237.21 port 42778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 11 19:14:40 host2 sshd[987545]: Disconnected from invalid user nodeuser 182.93.7.194 port 44650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.93
country_id: 6252001
description:
2025-11-11 19:16:55 dovecot_login authenticator failed for ([127.0.0.1]) [70.174.168.93]:46528: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.54.97.251
country_id: 3469034
description:
2025-11-11 19:17:08 dovecot_login authenticator failed for ([127.0.0.1]) [177.54.97.251]:46580: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 11 19:17:35 host2 sshd[989155]: Disconnected from invalid user newuser 182.93.7.194 port 45534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 11 19:19:51 host2 sshd[990097]: Disconnected from invalid user temp 45.78.237.21 port 35512 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 19:20:59 host2 sshd[990778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 11 19:20:36 host2 sshd[990632]: Disconnected from invalid user test 182.93.7.194 port 60542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.134
country_id: 798549
description:
2025-11-11 19:21:01 dovecot_login authenticator failed for (ADMIN) [91.90.120.134]:42790: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.203
country_id: 1880251
description:
Nov 11 19:22:08 host2 sshd[991428]: Disconnected from invalid user temp 101.47.50.203 port 51170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 19:23:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<NDG3+FFDQM9D1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 11 19:24:52 host2 sshd[992675]: Disconnected from invalid user admin 45.78.237.21 port 37880 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.50.203
country_id: 1880251
description:
Nov 11 19:27:25 host2 sshd[994017]: Disconnected from invalid user sysadmin 101.47.50.203 port 55530 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 11 19:29:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OqRwD1JD1oJAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 11 19:30:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.91, TLS: Connection closed, session=<YBKTEVJDQpNAPpzA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 19:42:16 host2 sshd[1002300]: Disconnected from invalid user user 2.57.121.25 port 13033 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-11 19:43:13 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:43146: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-11 19:43:42 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:53359: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.203
country_id: 1880251
description:
Nov 11 19:46:06 host2 sshd[1005134]: Disconnected from invalid user user40 101.47.50.203 port 52206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.208
country_id: 1880251
description:
Nov 11 19:48:46 host2 sshd[1006594]: Disconnected from invalid user alex 45.78.201.208 port 57146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.232.110
country_id: 1861060
description:
Nov 11 19:49:30 host2 sshd[1006986]: Disconnected from invalid user ubuntu 43.163.232.110 port 57626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 19:51:12 host2 sshd[1008020]: Disconnected from invalid user admin 2.57.121.112 port 6550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.24
country_id: 6290252
description:
2025-11-11 19:52:17 dovecot_login authenticator failed for (ADMIN) [37.46.115.24]:44892: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.67.147.33
country_id: 3017382
description:
Nov 11 19:52:39 host2 sshd[1008833]: Disconnected from invalid user odoo 82.67.147.33 port 53192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.67.147.33
country_id: 3017382
description:
Nov 11 19:53:46 host2 sshd[1009396]: Disconnected from invalid user lucas 82.67.147.33 port 59054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.147.33
country_id: 3017382
description:
Nov 11 19:54:50 host2 sshd[1010397]: Disconnected from invalid user www 82.67.147.33 port 34300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.119
country_id: 1643084
description:
Nov 11 19:55:54 host2 sshd[1011000]: Disconnected from invalid user it 103.23.199.119 port 56942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.67.147.33
country_id: 3017382
description:
Nov 11 19:56:04 host2 sshd[1011098]: Disconnected from invalid user kira 82.67.147.33 port 51542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.67.147.33
country_id: 3017382
description:
Nov 11 19:57:12 host2 sshd[1011669]: Disconnected from invalid user admin 82.67.147.33 port 57834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.232.110
country_id: 1861060
description:
Nov 11 19:57:55 host2 sshd[1012002]: Disconnected from invalid user lucas 43.163.232.110 port 34036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.232.110
country_id: 1861060
description:
Nov 11 19:59:24 host2 sshd[1013094]: Disconnected from invalid user sftp 43.163.232.110 port 36322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.119
country_id: 1643084
description:
Nov 11 20:00:03 host2 sshd[1013550]: Disconnected from invalid user user6 103.23.199.119 port 57306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 20:01:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<bWzzgVJD9IpD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.119
country_id: 1643084
description:
Nov 11 20:04:09 host2 sshd[1016337]: Disconnected from invalid user roo 103.23.199.119 port 49110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 20:04:20 host2 sshd[1016471]: Disconnected from invalid user bridgette 62.60.131.157 port 10567 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.119
country_id: 1643084
description:
Nov 11 20:06:15 host2 sshd[1017883]: Disconnected from invalid user alex 103.23.199.119 port 50860 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.50.132.240
country_id: 3469034
description:
[2025-11-11 20:07:05 +0530] info [cpaneld] 38.50.132.240 - euroente "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-11 20:11:27 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-11-11 20:13:51 dovecot_login authenticator failed for ([125.23.202.194]) [125.23.202.194]:50580: 535 Incorrect authentication data (set_id=jobs@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.35.211
country_id: 1643084
description:
2025-11-11 20:14:37 dovecot_login authenticator failed for ([36.92.35.211]) [36.92.35.211]:47746: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 20:16:23 host2 sshd[1024829]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.16
country_id: 1227603
description:
2025-11-11 20:20:38 dovecot_login authenticator failed for (ADMIN) [95.181.239.16]:47316: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov 11 20:21:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<9fohyVJDptbE+1g2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.233.91
country_id: 6252001
description:
Nov 11 20:22:24 host2 pure-ftpd[1028493]: (?@167.172.233.91) [INFO] New connection from 167.172.233.91


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov 11 20:23:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<A0wx0FJDCMDE+1g2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov 11 20:25:07 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<qIFY1VJDItHE+1g2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov 11 20:26:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<cee12FJDXM3E+1g2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov 11 20:27:18 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<Qqcb3VJDstvE+1g2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 11 20:32:50 host2 sshd[1035164]: Disconnected from invalid user debian 83.49.192.37 port 57962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-11 20:33:02 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49259: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 11 20:34:09 host2 sshd[1035848]: Disconnected from invalid user userftp 83.49.192.37 port 36452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.147
country_id: 1880251
description:
Nov 11 20:34:34 host2 sshd[1036196]: Disconnected from invalid user userftp 45.78.229.147 port 34694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.11
country_id: 1733045
description:
2025-11-11 20:37:07 dovecot_login authenticator failed for ([49.124.151.11]) [49.124.151.11]:38456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 11 20:38:00 host2 sshd[1038141]: Disconnected from invalid user mahdi 83.49.192.37 port 56930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-11 20:37:24 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:56609: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.121
country_id: 6252001
description:
2025-11-11 20:38:25 dovecot_login authenticator failed for (ADMIN) [151.241.123.121]:53150: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.210
country_id: 6252001
description:
Nov 11 20:39:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.210, lip=66.85.158.91, session=<NZ+XCFNDvrUs3LnS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 20:40:09 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<lz0PC1NDxLRD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.147
country_id: 1880251
description:
Nov 11 20:40:16 host2 sshd[1039533]: Disconnected from invalid user jenkins 45.78.229.147 port 44398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.99.144.248
country_id: 3686110
description:
Nov 11 20:41:26 host2 sshd[1040218]: Disconnected from invalid user aso 190.99.144.248 port 20558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-11-11 20:45:49 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:47036: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.99.144.248
country_id: 3686110
description:
Nov 11 20:46:00 host2 sshd[1043158]: Disconnected from invalid user deploy 190.99.144.248 port 20328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.71
country_id: 6252001
description:
Nov 11 20:46:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.71, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2AqMIlND2L1iUARH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-11 20:47:13 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:43168: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.99.144.248
country_id: 3686110
description:
Nov 11 20:47:33 host2 sshd[1044279]: Disconnected from invalid user gast 190.99.144.248 port 20110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.147
country_id: 1880251
description:
Nov 11 20:51:09 host2 sshd[1046527]: Disconnected from invalid user testuser 45.78.229.147 port 52752 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 20:52:41 host2 sshd[1047234]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 11 20:55:02 host2 pure-ftpd[1049033]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-11-11 20:55:24 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:55452: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 20:56:15 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<n9vNRFNDTLMDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.201.122
country_id: 1269750
description:
Nov 11 20:56:56 host2 sshd[1050182]: Disconnected from invalid user sd 165.154.201.122 port 60846 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 20:58:04 host2 sshd[1051041]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.201.122
country_id: 1269750
description:
Nov 11 20:58:29 host2 sshd[1051238]: Disconnected from invalid user jj 165.154.201.122 port 36040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 20:58:52 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<NpobTlNDHJcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.227
country_id: 6252001
description:
Nov 11 21:00:00 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.227, lip=66.85.158.92, session=<K0g1UlNDLajDuEzj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.7
country_id: 6252001
description:
Nov 11 20:59:42 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.7, lip=66.85.158.92, session=<C+UXUVNDI5DDuEwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.1
country_id: 6252001
description:
Nov 11 20:59:52 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.1, lip=66.85.158.92, session=<O0izUVND1bPDuEwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.225
country_id: 6252001
description:
Nov 11 21:00:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.225, lip=66.85.158.92, session=<UE1lUlNDVZ7DuEzh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.51.235.107
country_id: 6252001
description:
Nov 11 20:59:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.51.235.107, lip=66.85.158.91, session=<w5F8T1NDtocUM+tr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 20:59:15 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<kmmIT1NDMuIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 21:00:31 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<ga8GVFNDXNgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.164
country_id: 3865483
description:
Nov 11 21:00:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@agentallianz.com>, method=PLAIN, rip=190.181.101.164, lip=66.85.158.91, TLS, session=<oi1EU1NDP66+tWWk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.55
country_id: 6252001
description:
2025-11-11 21:00:51 dovecot_login authenticator failed for (ADMIN) [91.124.17.55]:34682: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.112
country_id: 3175395
description:
Nov 11 21:00:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.170.112, lip=66.85.158.91, TLS, session=<HJKcVFNDUbG5D6pw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 21:01:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<RHJ2VlNDgLwDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 21:02:10 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<dzvyWVNDcIEDhBfJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.89
country_id: 2635167
description:
Nov 11 21:03:31 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.89, lip=66.85.158.91, TLS, session=<79LGXlNDmeZX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 21:03:54 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<RkMpYFNDMsoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 11 21:04:20 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<twG0YVNDotgDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 21:05:34 host2 sshd[1056082]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.73.25.109
country_id: 6252001
description:
Nov 11 21:05:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=34.73.25.109, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Ky8NZlNDZpMiSRlt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.111
country_id: 6252001
description:
Nov 11 21:07:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.149.111, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LRx3a1NDWM6i2JVv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.111
country_id: 6252001
description:
Nov 11 21:08:00 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.111, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<79jQblND7vWi2JVv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.203.245.82
country_id: 6252001
description:
Nov 11 21:09:31 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.203.245.82, lip=66.85.158.92, session=<9xBAdFNDNIOsy/VS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.111
country_id: 6252001
description:
Nov 11 21:11:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.111, lip=66.85.158.92, TLS, session=<0CqOfFNDwvSi2JVv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-11 21:14:09 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:40506: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.62.39
country_id: 1522867
description:
2025-11-11 21:14:19 dovecot_login authenticator failed for 37.151.62.39.dynamic.telecom.kz [37.151.62.39]:53920: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-11-11 21:14:35 dovecot_login authenticator failed for ([196.190.43.139]) [196.190.41.137]:25395: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-11 21:14:35 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:33655: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 21:18:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<J+sglFNDsN5D1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 21:20:08 host2 sshd[1064150]: Disconnected from invalid user user 2.57.121.25 port 55280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.166
country_id: 294640
description:
2025-11-11 21:23:31 dovecot_login authenticator failed for (ADMIN) [149.88.26.166]:57238: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.2
country_id: 1269750
description:
2025-11-11 21:28:43 dovecot_login authenticator failed for ([59.145.114.82]) [128.185.219.2]:41536: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-11 21:28:26 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:35856: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.233
country_id: 6252001
description:
Nov 11 21:31:00 host2 pure-ftpd[1070327]: (?@205.210.31.233) [INFO] New connection from 205.210.31.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-11 21:36:47 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Nov 11 21:40:09 host2 sshd[1076221]: Disconnected from invalid user builder 45.78.205.117 port 33048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.124
country_id: 3017382
description:
Nov 11 21:49:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.196.152.124, lip=66.85.158.92, session=<S+RhBFRD+aNbxJh8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.38
country_id: 3017382
description:
Nov 11 21:50:00 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.38, lip=66.85.158.92, session=<x9AFBVRDVdJbxJgm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.124
country_id: 3017382
description:
Nov 11 21:50:18 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.124, lip=66.85.158.92, session=<AAMYBlRDV4tbxJh8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.126
country_id: 3017382
description:
Nov 11 21:50:22 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.126, lip=66.85.158.92, session=<sjtKBlRDCZ5bxJh+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.211
country_id: 6252001
description:
2025-11-11 21:52:08 dovecot_login authenticator failed for (ADMIN) [181.41.206.211]:49510: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 21:53:09 host2 sshd[1097241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 21:57:02 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<L3sLHlRDmppD1VIS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.117
country_id: 1880251
description:
Nov 11 21:57:27 host2 sshd[1099917]: Disconnected from invalid user odoo 45.78.205.117 port 53612 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.176
country_id: 798544
description:
Nov 11 21:57:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=193.192.179.176, lip=66.85.158.91, TLS, session=<rGUsH1RDIp/BwLOw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.36.162
country_id: 953987
description:
Nov 11 21:57:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.36.162, lip=66.85.158.91, TLS, session=<Ic5cIFRDEM1mQCSi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 22:05:54 host2 sshd[1105421]: Disconnected from invalid user admin 2.57.121.112 port 38617 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-11 22:06:02 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:35595: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-11 22:06:20 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:43522: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.224
country_id: 6252001
description:
Nov 11 22:08:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=162.216.150.224, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Sa8gRlRDx9qi2Jbg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.224
country_id: 6252001
description:
Nov 11 22:09:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=162.216.150.224, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<n1/YSVRD6vei2Jbg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Nov 11 22:09:45 host2 sshd[1107310]: Disconnected from invalid user ha 45.78.205.117 port 55822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-11 22:10:56 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:63301: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.23
country_id: 3042058
description:
2025-11-11 22:10:31 dovecot_login authenticator failed for (ADMIN) [91.90.122.23]:54788: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-11-11 22:11:20 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:52246: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Nov 11 22:14:42 host2 sshd[1110880]: Disconnected from invalid user ubuntu 45.78.205.117 port 34398 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.224
country_id: 6252001
description:
Nov 11 22:16:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.224, lip=66.85.158.91, TLS, session=<MfOsY1RDuOai2Jbg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.224
country_id: 6252001
description:
Nov 11 22:17:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.224, lip=66.85.158.91, TLS, session=<NXfSZlRDZuCi2Jbg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-11 22:23:14 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:40086: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-11 22:24:01 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:55920: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.117
country_id: 1880251
description:
Nov 11 22:29:36 host2 sshd[1119378]: Disconnected from invalid user embedded 45.78.205.117 port 46646 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 22:34:17 host2 sshd[1121739]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.213.82.18
country_id: 6251999
description:
Nov 11 22:35:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=67.213.82.18, lip=66.85.158.91, session=<oXbUqFRDkMRD1VIS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 22:36:53 host2 sshd[1123334]: Disconnected from invalid user admin 2.57.121.112 port 5418 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov 11 22:36:57 host2 pure-ftpd[1123399]: (?@147.185.132.234) [INFO] New connection from 147.185.132.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.83
country_id: 390903
description:
2025-11-11 22:40:33 dovecot_login authenticator failed for (ADMIN) [79.127.181.83]:26152: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.188
country_id: 6252001
description:
Nov 11 22:45:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.188, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YUQvy1RDJ/dAPpy8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 11 22:45:45 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YwdczFRDUE1APpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.208.45
country_id: 6251999
description:
Nov 11 22:48:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.208.45, lip=66.85.158.92, session=<cw2/1lRD4qGUcdAt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.4
country_id: 6252001
description:
Nov 11 22:48:46 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.92, session=<CwAn11RDALPLN4ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 11 22:54:27 host2 sshd[1134141]: Disconnected from invalid user user 2.57.121.25 port 45375 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.216
country_id: 3077311
description:
Nov 11 22:57:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=85.163.38.216, lip=66.85.158.91, TLS, session=<YKpG9FRDcatVoybY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-11 22:56:40 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:32786: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-11 22:56:54 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:36673: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.100.13.5
country_id: 458258
description:
Nov 11 22:57:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=94.100.13.5, lip=66.85.158.91, TLS, session=<OotZ9VRD+5heZA0F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.61
country_id: 1668284
description:
2025-11-11 23:09:39 dovecot_login authenticator failed for (ADMIN) [173.244.49.61]:42430: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


